Security Alert Summary
The SmartAIPress plugin through 1.2.0 contains a server-side request forgery (SSRF) vulnerability. An AJAX action lacks a capability check and does not validate a user-supplied URL before fetching it server-side, allowing authenticated users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response.
CVE Details
- CVE ID: CVE-2026-16600
- Affected component: SmartAIPress WordPress plugin
- Affected versions: Versions up to and including 1.2.0
- Published: August 29, 2026 at 6:17:05 AM
- Last modified: August 29, 2026 at 6:17:05 AM
- CVSS v3.1: Not provided in the JSON
- Authentication required: Yes. The issue is exploitable by users with subscriber-level access and above (authenticated users).
- Privileges required: Subscriber-level access or higher, per the description.
- User interaction: Requires an authenticated user to trigger the vulnerable AJAX action; no additional interaction details provided.
- Primary impact:
- Confidentiality: Disclosure risk. The vulnerability allows reading responses from arbitrary internal or external URLs, which can expose internal resources or sensitive data.
- Integrity: Limited. The description indicates read access to fetched responses but does not describe modification of server data.
- Availability: Not specified. The report describes a full-read SSRF rather than direct denial-of-service.
- CWE / weakness ID: Not specified in the JSON
Technical Details
The plugin fails to perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before performing a server-side fetch. Because an authenticated user at subscriber-level or above can invoke this action and supply an arbitrary URL, the site can be forced to retrieve internal or external URLs and return the response to the requester. The report describes this as a full-read Server-Side Request Forgery (SSRF).
No specific function names or REST API endpoints are provided in the JSON. The core issue is the combination of a missing authorization/capability check on an AJAX handler and the absence of input validation for the URL being fetched, which together permit SSRF-style reads of remote resources from the server context.
Impact is limited to what the server can access and return: internal APIs, metadata endpoints, or externally hosted content reachable from the server could be read. The description does not claim remote code execution or automatic elevation of privileges.
How This Could Impact Your Website
Consider a small team managing a WordPress site: the site owner maintains administrative control, editors manage content, and external contractors or contributors may hold subscriber or contributor accounts. If a user with subscriber-level access or higher triggers the vulnerable AJAX action, they could cause the site to fetch internal endpoints or external URLs and read the response. That could expose internal data, API responses, or other resources that were not intended to be public.
Practical consequences include potential exposure of internal user email addresses or other resource contents accessible from the server, and an increased risk of targeted phishing or social engineering against staff or contractors who are identifiable from exposed data. The vulnerability is a read-oriented SSRF; it does not necessarily imply full site takeover based on the information provided.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributors and other non-administrative accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, such as unexpected AJAX requests or outbound requests initiated by authenticated users.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
