CVE-2026-16600: CWE-918 Server-Side Request Forgery (SSRF) in SmartAIPress
Description
SmartAIPress WordPress plugin versions through 1.2.0 contain a Server-Side Request Forgery (SSRF) vulnerability. This occurs because the plugin does not perform capability checks on a specific AJAX action and fails to validate user-supplied URLs before fetching them server-side. As a result, users with subscriber-level access or higher can make the site retrieve arbitrary internal or external URLs and read the responses.
CVSS v3.1
Score 7.7high
Affected software
SmartAIPress
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The SmartAIPress WordPress plugin up to version 1.2.0 has an SSRF vulnerability (CWE-918) due to missing capability checks and lack of URL validation in one of its AJAX actions. This flaw allows authenticated users with subscriber-level privileges or above to cause the server to fetch arbitrary URLs and read the responses, potentially exposing internal resources or sensitive data accessible via the server.
Potential Impact
An attacker with subscriber-level access or higher can exploit this vulnerability to make the server perform arbitrary HTTP requests to internal or external resources and read the responses. This can lead to unauthorized information disclosure and potentially further attacks leveraging internal network access. The vulnerability does not impact integrity or availability directly but has a high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict subscriber-level user capabilities if possible and monitor for suspicious activity related to AJAX requests. Avoid exposing this plugin on sensitive environments without proper access controls.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- WPScan
- Date Reserved
- 2026-07-22T14:12:51.034Z
- State
- PUBLISHED
Threat ID: 6a927ab4acd9273b496bde6b
Added to database: 08/29/2026, 06:22:44 UTC
Last enriched: 09/08/2026, 02:52:26 UTC
Last updated: 10/13/2026, 18:48:17 UTC
Views: 61
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.