All In One Image Viewer Block Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the All In One Image Viewer Block plugin for WordPress, affecting all versions through 1.0.2. The vulnerability arises from inadequate authorization and URL validation on the image-proxy REST API endpoint. This flaw allows unauthenticated attackers to send web requests to arbitrary locations via the web application, potentially accessing and modifying information from internal services.

Impact

Exploitation of this vulnerability allows for unauthorized web requests to be made from the WordPress application to external or internal services, which could be used to access or manipulate sensitive information or resources.

Remediation

Users are advised to update the All In One Image Viewer Block plugin to version 1.0.3 or a newer patched version.