CVE-2025-12359 is a Server-Side Request Forgery vulnerability in the Responsive Lightbox & Gallery WordPress plugin, affecting all versions up to 2.5.3. The issue arises from insufficient validation of user-supplied URLs in the 'get_image_size_by_url' function, enabling authenticated users with Author-level access or higher to cause the server to make arbitrary HTTP requests. This can be leveraged to interact with internal services that are otherwise inaccessible externally. The vulnerability has a CVSS 3.1 score of 5.4, indicating medium severity. No patch or vendor advisory is currently provided, and no known exploits are reported in the wild.

An attacker with Author-level or higher privileges can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This may lead to unauthorized information disclosure or modification of internal services accessible from the server. The impact is limited by the requirement for authenticated access at Author level or above. There is no indication of direct denial of service or remote code execution from the available data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing sensitive internal services that could be targeted via SSRF. Apply principle of least privilege for WordPress user roles to reduce risk.