CVE-2026-27759 is an authenticated SSRF vulnerability in the Featured Image from Content WordPress plugin by Dhrumil Kumbhani, affecting versions prior to 1.7. The vulnerability allows users with Author-level permissions to abuse insecure URL fetching and file write operations to access internal HTTP resources and save sensitive data in locations accessible via the web server. This can expose internal data that should otherwise be protected. The CVSS 4.0 base score is 5.3, indicating a medium severity risk. No patch or official fix has been documented, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker with Author-level access can exploit this vulnerability to perform SSRF attacks, potentially accessing sensitive internal HTTP resources that are not normally exposed externally. The attacker can also write retrieved data to web-accessible upload directories, increasing the risk of data leakage. This could lead to unauthorized disclosure of internal information. However, exploitation requires authenticated access at the Author level, limiting the attack surface. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently documented, users should monitor for updates from the plugin vendor. As a temporary mitigation, restrict Author-level user permissions or disable the plugin until a fix is available. Avoid granting Author-level access to untrusted users to reduce risk.