CVE-2026-61970 describes an SSRF vulnerability in the Themeisle Auto Featured Image (Auto Post Thumbnail) WordPress plugin affecting versions up to 5.0.4. The vulnerability enables an attacker with low privileges to cause the server to perform unauthorized requests, potentially leading to limited confidentiality and integrity impacts. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and a scope change with partial confidentiality and integrity impact but no availability impact. No vendor advisory or patch information is available at this time.

An attacker with low privileges can exploit this SSRF vulnerability to make the server send crafted requests to internal or external resources. This may lead to partial disclosure of sensitive information and modification of data, but does not affect availability. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the plugin and monitor for suspicious activity related to server requests. Avoid exposing the plugin to untrusted users if possible.