Server-Side Request Forgery Vulnerability in Converter for Media Plugin by WordPress

CVE-2026-1356

What is CVE-2026-1356?

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is exposed to a Server-Side Request Forgery (SSRF) vulnerability in all versions up to 6.5.1. Through the PassthruLoader::load_image_source function, unauthenticated attackers can exploit this vulnerability to send crafted requests, potentially accessing and modifying information from internal services. This security flaw emphasizes the importance of securing web applications against unauthorized internal communications.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References