CVE-2022-1037: 
WordPress vulnerability analysis and mitigation

CVE-2022-1037 is a security vulnerability affecting the EXMAGE WordPress plugin versions before 1.0.7. The vulnerability was discovered and publicly disclosed on March 28, 2022, by Luan Pedersini from IBLISS Digital Security. This vulnerability stems from the plugin's failure to properly validate whether images added via URLs are external images (WPScan).

The vulnerability is classified as a Server-Side Request Forgery (SSRF) issue, specifically a blind SSRF vulnerability (CWE-918). It has been assigned a CVSS 3.1 Base Score of 7.2 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. The vulnerability falls under the OWASP Top 10 category A1: Injection (NVD, WPScan).

The vulnerability allows an authenticated user with administrative privileges to potentially execute blind SSRF attacks by using local URLs. This could enable attackers to probe and interact with internal network resources that should not be accessible from external networks (WPScan).

The vulnerability can be exploited by placing an internal URL (such as http://127.0.0.1:8080) in the 'Save storage by using external image URLs (one line each)' feature of the plugin, which can be accessed through the WordPress admin panel at /wp-admin/media-new.php (WPScan).

The vulnerability has been fixed in version 1.0.7 of the EXMAGE WordPress plugin. Users are advised to update to this version or later to mitigate the security risk (WPScan).