The All In One Image Viewer Block plugin for WordPress contains an SSRF vulnerability (CWE-918) due to missing authorization and URL validation on its image-proxy REST API endpoint. This flaw allows unauthenticated attackers to cause the server to send arbitrary HTTP requests to internal or external systems, potentially exposing or modifying sensitive information. The vulnerability affects all versions up to 1.0.2. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope change.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable server send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized access to internal services, information disclosure, and potential modification of data on those services. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin's image-proxy REST API endpoint to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.