CVE-2026-27759 Featured Image from Content < 1.7 Authenticated SSRF via save_post
Authenticated Authors can exploit SSRF in the Featured Image from Content plugin to fetch internal resources and store sensitive data in web-accessible directories.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-27759?
CVE-2026-27759 is a medium-severity server-side request forgery vulnerability in Dhrumil Kumbhani Featured Image from Content, published on 27 Feb 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerability that allows Author-level users to fetch internal HTTP resources. Attackers can exploit insecure URL fetching and file write operations to retrieve sensitive internal data and store it in web-accessible upload directories.
Weakness: CWE-918
Which versions are affected by CVE-2026-27759?
How do I fix CVE-2026-27759?
No fix has been published for CVE-2026-27759 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2026-27759 being exploited?
There is no known exploitation of CVE-2026-27759 in the wild and no public exploit code.
Sources
Also known as GHSA-pmx8-fmc2-4rjp.