Server-Side Request Forgery Vulnerability in Converter for Media Plugin by WordPress
CVE-2026-1356

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
Converter For Media – Optimize Images | Convert Webp & Avif
Vendor
CVE Published:
12 February 2026

What is CVE-2026-1356?

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is exposed to a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 6.5.1. Through the PassthruLoader::load_image_source function, unauthenticated attackers can exploit this vulnerability to send crafted requests, potentially accessing and modifying information from internal services. This security flaw emphasizes the importance of securing web applications against unauthorized internal communications.

Affected Version(s)

Converter for Media – Optimize images | Convert WebP & AVIF 0 <= 6.5.1

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset/3445904/webp...

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Lucas Montes
.