Authenticated Server-Side Request Forgery in Featured Image from Content Plugin by WordPress

CVE-2026-27759

What is CVE-2026-27759?

The Featured Image from Content plugin for WordPress prior to version 1.7 contains an authenticated server-side request forgery vulnerability. This security issue enables Author-level users to exploit vulnerable URL fetching and file write operations, potentially allowing unauthorized access to internal HTTP resources. Attackers could leverage this flaw to retrieve sensitive internal data, which may then be stored in web-accessible upload directories, increasing the risk of data exposure and subsequent security breaches.

References