CVE-2026-1294: 
WordPress vulnerability analysis and mitigation

CVE-2026-1294 is a Server-Side Request Forgery (SSRF) vulnerability in the All In One Image Viewer Block plugin for WordPress, developed by bPlugins. It affects all versions up to and including 1.0.2, and stems from missing authorization and URL validation on the plugin's image-proxy REST API endpoint. Unauthenticated attackers can exploit this flaw to make arbitrary web requests originating from the vulnerable server. It was published on February 5, 2026, and carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and is mapped to CAPEC-664. The root cause is a combination of missing authorization checks and absent URL validation on the image-proxy REST API endpoint exposed by the plugin (Wordfence). Because the endpoint requires no authentication and does not restrict the target URL, an unauthenticated attacker can supply an arbitrary URL, causing the WordPress server to issue HTTP requests to internal or external resources on the attacker's behalf. The vulnerable code is visible in the plugin source at image-viewer-block.php version 1.0.2, and the fix was introduced in the changeset for version 1.0.3 (Plugin Trac v1.0.2, Plugin Trac changeset).

Successful exploitation allows unauthenticated attackers to pivot the WordPress server into a proxy for reaching internal network services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other resources not directly accessible from the internet. The CVSS scope is marked as Changed, reflecting that the impact extends beyond the vulnerable component itself. Confidentiality and integrity are both rated Low — attackers can read responses from internal services and potentially modify state via HTTP-based internal APIs, though availability is not directly impacted (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the time of writing. The EPSS score is approximately 0.025%, indicating a low probability of exploitation in the near term (Feedly). The vulnerability is unauthenticated and requires no user interaction, making it trivially exploitable by any network-accessible attacker against a vulnerable WordPress installation. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify WordPress sites running the "All In One Image Viewer Block" plugin (version ≤ 1.0.2) using tools like WPScan, Shodan, or by checking /wp-content/plugins/image-viewer/ for the plugin's presence.
2. Locate the vulnerable endpoint: The plugin registers a REST API route accessible at /wp-json/<namespace>/image-proxy (or similar, as defined in image-viewer-block.php) that accepts a URL parameter without authentication.
3. Craft the SSRF request: Send an unauthenticated HTTP GET or POST request to the endpoint with a target URL pointing to an internal resource, e.g.:

   GET /wp-json/image-viewer/v1/image-proxy?url=http://169.254.169.254/latest/meta-data/ HTTP/1.1
   Host: target-wordpress-site.com

4. Retrieve internal data: The server fetches the specified URL and returns the response body, potentially exposing cloud instance metadata, internal API responses, or other sensitive information from the internal network.
5. Pivot or escalate: Use retrieved credentials or tokens (e.g., from cloud metadata) to escalate privileges or move laterally within the hosting environment (Wordfence, Plugin Trac v1.0.2).

• Network: Outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254, fd00:ec2::254) that are not initiated by legitimate application logic.
• Logs: WordPress access logs (access.log) showing repeated requests to the REST API endpoint path containing image-proxy with unusual or internal url parameter values from external IP addresses.
• Logs: Web server error logs showing connection timeouts or refused connections to internal hosts, indicating SSRF probing of closed ports.
• Network: Unexpected DNS queries from the WordPress server for internal hostnames or cloud provider metadata domains originating from the web process.

The vendor (bPlugins) released version 1.0.3 of the All In One Image Viewer Block plugin, which adds proper authorization checks and URL validation to the image-proxy REST API endpoint (Plugin Trac changeset). Site administrators should update the plugin to version 1.0.3 or later immediately via the WordPress admin dashboard or WP-CLI (wp plugin update image-viewer). As a temporary workaround if updating is not immediately possible, the plugin can be deactivated, or a Web Application Firewall (WAF) rule can be deployed to block unauthenticated requests to the image-proxy REST API route.

Wordfence included this vulnerability in their weekly WordPress vulnerability report for the period of February 2–8, 2026, noting it as part of a broader set of plugin-level SSRF issues (Wordfence Blog). The vulnerability was also picked up by several security aggregators and alert services including Red Hat, INCIBE-CERT, and CCN-CERT, reflecting standard industry tracking of WordPress plugin vulnerabilities (Red Hat CVE). No notable independent researcher commentary or significant social media discussion has been identified beyond routine CVE publication coverage.