CVE-2026-16600

SmartAIPress WordPress plugin versions through 1.2.0 contain a full-read Server-Side Request Forgery (SSRF) flaw (CWE-918): one of the plugin's AJAX actions lacks a capability check and does not validate a user-supplied URL before the server fetches it. Any authenticated user with subscriber-level access (the lowest-privilege role in WordPress) or higher can invoke the action, making the site's web server request an arbitrary internal or external URL and return the response to the attacker. An attacker therefore gains read access to resources reachable from the web server, such as internal network services or localhost-only endpoints, which CVSS rates as high confidentiality impact with no integrity or availability impact. Only WordPress installations running the SmartAIPress plugin at version 1.2.0 or earlier are affected. There is currently no known exploitation, no public proof of concept, and the EPSS score of 0.2% (10th percentile) indicates a low near-term probability of exploitation.

What to do: Update SmartAIPress to a patched release newer than 1.2.0 as soon as the vendor publishes one; until then, consider deactivating the plugin or restricting its AJAX action to trusted users via a WAF rule. As a precaution, review web logs for subscriber-level accounts triggering unexpected server-side requests to internal or external URLs.