CVE-2026-12106 is a CWE-918 SSRF vulnerability in the Auto Upload Images WordPress plugin (versions <=3.3.2). The plugin's downloadImage function uses wp_remote_get() without sufficient validation, allowing authenticated contributors or above to trigger server-side requests to arbitrary locations, including private and loopback IP ranges. The validate() method only blocks URLs matching the site's hostname but fails to block internal IP addresses such as 127.0.0.1, 10.0.0.0/8, and 169.254.169.254. Attackers exploit this by embedding crafted <img> tags with malicious src attributes in post content, which the plugin processes and fetches.

An attacker with contributor-level or higher access can cause the server to make HTTP requests to arbitrary internal or external addresses. This can potentially expose internal network resources or metadata services that are normally inaccessible externally. The vulnerability has a CVSS 3.1 score of 6.4 (medium severity) with impact on confidentiality and integrity but no direct availability impact. There are no known exploits in the wild at this time.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access and above to trusted users only. Avoid embedding untrusted image URLs in post content. Consider applying web application firewall rules to detect and block SSRF attempts targeting internal IP ranges. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.