CVE-2026-2479

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-2479", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-02-13T18:12:22.873Z", "datePublished": "2026-02-25T08:25:30.385Z", "dateUpdated": "2026-04-08T16:49:17.545Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:17.545Z"}, "affected": [{"vendor": "dfactory", "product": "Responsive Lightbox & Gallery", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in the `ajax_upload_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services."}], "title": "Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344"}, {"url": "https://plugins.trac.wordpress.org/changeset/3464566?contextall=1"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "baseScore": 5, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Lukasz Sobanski"}], "timeline": [{"time": "2026-02-13T18:27:37.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2026-02-24T20:06:06.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-25T16:50:17.514136Z", "id": "CVE-2026-2479", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:51:05.012Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-2479", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-25T16:50:17.514136Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-25T16:50:59.252Z"}}], "cna": {"title": "Responsive Lightbox & Gallery <= 2.7.1 - Authenticated (Author+) Server-Side Request Forgery via Remote Library Image Upload", "credits": [{"lang": "en", "type": "finder", "value": "Lukasz Sobanski"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N"}}], "affected": [{"vendor": "dfactory", "product": "Responsive Lightbox & Gallery", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-13T18:27:37.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2026-02-24T20:06:06.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329"}, {"url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344"}, {"url": "https://plugins.trac.wordpress.org/changeset/3464566?contextall=1"}], "descriptions": [{"lang": "en", "value": "The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in the `ajax_upload_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:49:17.545Z"}}}, "cveMetadata": {"cveId": "CVE-2026-2479", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:49:17.545Z", "dateReserved": "2026-02-13T18:12:22.873Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-25T08:25:30.385Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Responsive Lightbox & Gallery", "vendor": "dfactory", "versions": [{"lessThanOrEqual": "2.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.7.1. This is due to the use of `strpos()` for substring-based hostname validation instead of strict host comparison in the `ajax_upload_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Responsive Lightbox &amp; Gallery para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 2.7.1, inclusive. Esto se debe al uso de `strpos()` para la validaci\u00f3n de nombres de host basada en subcadenas en lugar de una comparaci\u00f3n estricta de host en la funci\u00f3n `ajax_upload_image()`. Esto permite a atacantes autenticados, con acceso de nivel Autor o superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web, lo que puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2026-2479", "lastModified": "2026-06-17T10:31:08.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-2479", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-02-25T16:50:17.514136Z", "version": "2.0.3"}}]}, "published": "2026-02-25T09:16:15.547", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L329"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/tags/2.7.0/includes/class-remote-library.php#L344"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/responsive-lightbox/trunk/includes/class-remote-library.php#L329"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3464566?contextall=1"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/44276b28-9509-4f59-936c-fff2ae404076?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,2.7.1]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Responsive Lightbox & Gallery", "source": "cna", "vendor": "dfactory"}, "product": "responsive_lightbox_&_gallery", "vendor": "dfactory"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-15T18:04:53.365510+00:00", "value": {"mitigation_remediation": ["Upgrade Responsive Lightbox & Gallery to the latest released version, preferably beyond 2.7.1, where the hostname validation logic has been corrected.", "If an upgrade is not immediately possible, remove or disable the remote library image upload feature provided by the plugin to block the vulnerable endpoint.", "Restrict Author permissions on the site or enforce stricter role management so that only trusted users have the ability to trigger the remote upload function.", "Configure network firewall or WordPress outbound request filters to block unexpected external HTTP requests originating from the site's web server."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "Database: WordPress plugin Responsive Lightbox & Gallery. All releases up to and including 2.7.1 are affected. The vulnerability can be exploited only by users with Author role or higher, so any site that has author\u2011level accounts is susceptible. Upgraded or patched versions after 2.7.1 are not impacted.", "description_and_impact": "The plugin contains an unsafe hostname validation that allows an attacker with Author or higher privileges to trigger HTTP requests to arbitrary hosts from the server. This Server\u2011Side Request Forgery can be used to read or modify data from internal services, leading to potential confidentiality and integrity violations. The flaw arises from using strpos for substring detection rather than strict host comparison, a classic input\u2011validation weakness identified as CWE\u2011918.", "risk_and_exploitability": "The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of automated exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread active exploitation. However, attackers who can elevate to author privileges or are already authenticated can manually craft a request to supply an arbitrary URL, making the attack feasible in targeted environments. The primary attack vector is an authenticated host\u2011side request, relying on internal WordPress authorization to submit the malicious URL to the vulnerable endpoint."}}}}, "created": "2026-02-26T13:18:21.512400+00:00", "updated": "2026-04-15T18:15:10.820553+00:00", "vendors": ["dfactory", "dfactory$PRODUCT$responsive_lightbox_&_gallery", "wordpress", "wordpress$PRODUCT$wordpress"]}