Blind Server-Side Request Forgery in Post to Google My Business Plugin for WordPress
CVE-2026-127217

5.3MEDIUM

Key Information:

Vendor

WordPress
Status
Post To Google My Business (google Business Profile)
Vendor
CVE Published:
13 November 2026

What is CVE-2026-127217?

The Post to Google My Business plugin for WordPress versions prior to 3.5.7 is susceptible to a blind server-side request forgery vulnerability. This flaw allows authenticated users with Contributor-level privileges and above to send arbitrary requests from the server. By manipulating an unvalidated URL input during image size validation via the preview REST route, attackers can potentially exploit this vulnerability to perform activities such as internal port scanning and probing of services not accessible externally. This could lead to unauthorized access to internal systems and bypass of network security measures, ultimately compromising the integrity of the web server.

Affected Version(s)

Post to Google My Business (Google Business Profile) 0 < 3.5.7

References

https://wordpress.org/plugins/post-to-google-my-business/...
release-notespatch
https://www.vulncheck.com/advisories/post-to-google-my-bu...
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

buiih
.