WordPress WebP Converter for Media Plugin Server-Side Request Forgery Vulnerability

A Server-Side Request Forgery (SSRF) vulnerability has been identified in the WordPress WebP Converter for Media plugin, specifically in versions prior to and including 6.5.1. The issue arises in the PassthruLoader::load_image_source function, allowing unauthenticated attackers to send web requests to arbitrary locations from the web application. This could be exploited to query and modify information from internal services.

Impact

Exploitation of this vulnerability could lead to unauthorized web requests being made from the affected server, potentially allowing attackers to access or manipulate data from internal services.

Remediation

Users can update to version 6.5.2 or later to address this vulnerability.