CVE-2026-1356

MEDIUM

Converter for Media - Optimize images | Convert WebP & AVIF plugin ...

Title source: llm
STIX 2.1

Description

The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

References (2)

Core 2

Scores

CVSS v3 4.8
EPSS 0.0023
EPSS Percentile 13.5%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-918
Status published
Products (1)
mateuszgbiorczyk/Converter for Media – Optimize images | Convert WebP & AVIF < 6.5.1
Published Feb 12, 2026
Tracked Since Feb 18, 2026