CVE-2026-1294
📋 TL;DR
The All In One Image Viewer Block WordPress plugin has a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to make arbitrary web requests from the vulnerable server. This can be used to query internal services, potentially exposing sensitive information or enabling further attacks. All WordPress sites using this plugin up to version 1.0.2 are affected.
💻 Affected Systems
- All In One Image Viewer Block WordPress plugin
⚠️ Risk & Real-World Impact
Worst Case
Attackers could access internal services, steal sensitive data, pivot to internal networks, or perform actions on behalf of the server.
Likely Case
Information disclosure from internal services, reconnaissance of internal network, or limited data exfiltration.
If Mitigated
Limited impact if network segmentation prevents access to sensitive internal services.
🎯 Exploit Status
SSRF vulnerabilities are commonly exploited and require minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.3
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3449642/image-viewer/tags/1.0.3/image-viewer-block.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'All In One Image Viewer Block'. 4. Click 'Update Now' if available, or manually update to version 1.0.3. 5. Verify the plugin is updated to 1.0.3 or later.
🔧 Temporary Workarounds
Disable the vulnerable plugin
allTemporarily deactivate the All In One Image Viewer Block plugin until patched.
wp plugin deactivate image-viewer
Restrict access to image-proxy endpoint
linuxUse web application firewall or .htaccess to block access to the vulnerable REST API endpoint.
# Add to .htaccess:
RewriteCond %{REQUEST_URI} ^/wp-json/image-viewer/v1/image-proxy
RewriteRule .* - [F]
🧯 If You Can't Patch
- Disable the plugin immediately
- Implement network segmentation to isolate the WordPress server from internal services
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Installed Plugins for 'All In One Image Viewer Block' version 1.0.2 or earlier.Check Version:
wp plugin get image-viewer --field=versionVerify Fix Applied:
Confirm plugin version is 1.0.3 or later in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to /wp-json/image-viewer/v1/image-proxy endpoint
- Outbound requests from WordPress server to internal IP addresses
Network Indicators:
- HTTP requests from WordPress server to internal services on unusual ports
- Traffic patterns suggesting internal network scanning
SIEM Query:
source="wordpress.log" AND uri="/wp-json/image-viewer/v1/image-proxy"🔗 References
- https://plugins.trac.wordpress.org/browser/image-viewer/tags/1.0.2/image-viewer-block.php#L10
- https://plugins.trac.wordpress.org/changeset/3449642/image-viewer/tags/1.0.3/image-viewer-block.php?old=3405983&old_path=image-viewer%2Ftags%2F1.0.2%2Fimage-viewer-block.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7c3f7108-eb32-425a-a705-4f032e7da6b0?source=cve
