SSRF in Dhrumil Kumbhani Featured Image From Content
CVE-2026-27759
Featured Image from Content (featured-image-from-content) WordPress plugin versions prior to 1.7 contain an authenticated server-side request forgery vulnerability that allows Author-level users to fetch internal HTTP resources. Attackers can exploit insecure URL fetching and file write operations to retrieve sensitive internal data and store it in web-accessible upload directories.
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.002 (14.5th percentile) — read the EPSS interpretation.
Affected products
- Dhrumil Kumbhani Featured Image From Content — versions 0
Weakness classification (CWE)
References
- disclosure@vulncheck.com (product, patch)
- disclosure@vulncheck.com (third-party-advisory)