LMDeploy CVE-2026-33626 Flaw Exploited Within 13 Hours of Disclosure
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-0740 | Unauthenticated Arbitrary File Upload RCE in Ninja Forms File Uploads WordPress Plugin CVE-2026-0740 is a critical (CVSS 9.8) unauthenticated arbitrary file upload vulnerability in the Ninja Forms - File Uploads plugin for WordPress, affecting all versions up to and including 3.3.26. It is caused by missing file type validation in the NF_FU_AJAX_Controllers_Uploads::handle_upload function, so anyone can send a crafted request to the plugin's upload AJAX endpoint with no account, no privileges, and no user interaction. Because uploaded file types are not validated, an attacker can plant arbitrary files, such as PHP scripts, on the web server, which may enable remote code execution and full compromise of the site. Any WordPress site running the File Uploads add-on for Ninja Forms at version 3.3.26 or earlier is exposed, especially sites that accept front-end uploads from visitors. The flaw was partially patched in 3.3.25 and fully fixed in 3.3.27; no public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 62.9% EPSS score (99th percentile) signals a high likelihood of exploitation within 30 days. Do: Update the Ninja Forms - File Uploads add-on to version 3.3.27 or later, since 3.3.25-3.3.26 contain only a partial fix. Until patched, restrict or disable unauthenticated front-end uploads and block unauthenticated requests to the plugin's upload AJAX endpoint via WAF rules. Audit the uploads directories for unexpected PHP files or webshells, as arbitrary uploads may have enabled code execution. | 9.8 | 63% |
| largelikely tens of thousands of sites (roughly 10,000-100,000; premium add-on to a core plugin with ~900k+ active installs) | ||
| CVE-2026-33626 | SSRF in LMDeploy vision-language module exposes cloud metadata and internal networks LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models, contains a server-side request forgery (SSRF) flaw in its vision-language module. The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs supplied to image-loading requests without validating that the resolved host is not an internal or private IP address, so any unauthenticated network caller can direct the server to request attacker-chosen URLs. An attacker can leverage this to reach cloud metadata services (e.g., to steal instance credentials), probe internal networks, and access other sensitive resources reachable from the LMDeploy server. Anyone running LMDeploy versions prior to 0.12.3, particularly deployments exposing the vision-language serving API to untrusted networks, is affected. The flaw was reportedly exploited in the wild within 13 hours of disclosure, and version 0.12.3 patches the issue. Do: Upgrade to LMDeploy 0.12.3 or later. Until patched, restrict network access to LMDeploy serving endpoints, apply egress filtering so the server can only reach approved hosts, and block requests to private IP ranges and cloud metadata endpoints (e.g., 169.254.169.254); review server logs for unexpected outbound URL fetches or signs of metadata-service access. | 7.5 | 45% | PoC |
| moderateestimated on the order of low thousands of self-hosted LMDeploy serving instances worldwide | |
| CVE-2026-3844 | Unauthenticated Arbitrary File Upload in Breeze Cache WordPress Plugin CVE-2026-3844 is a critical (CVSS 9.8) arbitrary file upload vulnerability in the Breeze Cache plugin for WordPress, caused by missing file type validation in the 'fetch_gravatar_from_remote' function in all versions up to and including 2.4.4. An unauthenticated attacker can trigger the function over the network and upload arbitrary files to the affected site's server, but the flaw is only exploitable when the 'Host Files Locally - Gravatars' option is enabled, which is disabled by default. Uploaded files can include executable PHP such as web shells, so successful exploitation may make remote code execution and full site or server compromise possible. Any WordPress site running Breeze Cache 2.4.4 or earlier with local Gravatar hosting switched on is affected, and press coverage reports more than 400,000 sites at risk. Headlines indicate attackers are already exploiting the flaw in the wild; no public proof-of-concept is known, the EPSS score of 27.7% (98th percentile) signals high near-term exploitation risk, and the CVE is not yet in CISA's KEV. Do: Sites running Breeze Cache should update to the latest patched release (any version after 2.4.4); if updating is not immediately possible, disable the 'Host Files Locally - Gravatars' setting to close the attack path. Administrators should also audit uploaded files and the webroot for unexpected PHP files or web shells and check site integrity for signs of compromise, given reports of active exploitation and related WordPress backdoor campaigns. | 9.8 | 28% |
| mass≈400,000+ WordPress sites at risk |
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | requestrepo.com | rver. Test egress with an out-of-band (OOB) DNS callback to requestrepo[.]com to confirm the SSRF vulnerability can reach arbitrary ext |
Full article676 words · extracted from thehackernews.com · click to collapse
A high-severity security flaw in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs), has come under active exploitation in the wild less than 13 hours after its public disclosure.
The vulnerability, tracked as CVE-2026-33626 (CVSS score: 7.5), relates to a Server-Side Request Forgery (SSRF) vulnerability that could be exploited to access sensitive data.
"A server-side request forgery (SSRF) vulnerability exists in LMDeploy's vision-language module," according to an advisory published by the project maintainers last week. "The load_image() function in lmdeploy/vl/utils.py fetches arbitrary URLs without validating internal/private IP addresses, allowing attackers to access cloud metadata services, internal networks, and sensitive resources."
The shortcoming affects all versions of the toolkit (0.12.0 and prior) with vision language support. Orca Security researcher Igor Stepansky has been credited with discovering and reporting the bug.
Successful exploitation of the vulnerability could permit an attacker to steal cloud credentials, reach internal services that aren't exposed to the internet, port scan internal networks, and create lateral movement opportunities.
Cloud security firm Sysdig, in an analysis published this week, said it detected the first LMDeploy exploitation attempt against its honeypot systems within 12 hours and 31 minutes of the vulnerability being published on GitHub. The exploitation attempt originated from the IP address 103.116.72[.]119.
"The attacker did not simply validate the bug and move on. Instead, over a single eight-minute session, they used the vision-language image loader as a generic HTTP SSRF primitive to port-scan the internal network behind the model server: AWS Instance Metadata Service (IMDS), Redis, MySQL, a secondary HTTP administrative interface, and an out-of-band (OOB) DNS exfiltration endpoint," it said.
The actions undertaken by the adversary, detected on Apr 22, 2026, at 03:35 a.m. UTC, unfolded over 10 distinct requests across three phases, with the requests switching between vision language models (VLMs) such as internlm-xcomposer2 and OpenGVLab/InternVL2-8B to likely avoid raising any suspicion -
- Target AWS IMDS and Redis instances on the server.
- Test egress with an out-of-band (OOB) DNS callback to requestrepo[.]com to confirm the SSRF vulnerability can reach arbitrary external hosts, followed by enumerating the API surface.
- Port scan the loopback interface ("127.0.0[.]1")
The findings are yet another reminder of how threat actors are closely watching new vulnerability disclosures and exploiting them before downstream users can apply the fixes, even in cases where no proof-of-concept (PoC) exploits exist at the time of the attack.
"CVE-2026-33626 fits a pattern that we have observed repeatedly in the AI-infrastructure space over the past six months: critical vulnerabilities in inference servers, model gateways, and agent orchestration tools are being weaponized within hours of advisory publication, regardless of the size or extent of their install base," Sysdig said.
"Generative AI (GenAI) is accelerating this collapse. An advisory as specific as GHSA-6w67-hwm5-92mq, which includes the affected file, parameter name, root-cause explanation, and sample vulnerable code, is effectively an input prompt for any commercial LLM to generate a potential exploit."
WordPress Plugins and Internet-Exposed Modbus Devices Targeted
The disclosure comes as threat actors have also been spotted exploiting vulnerabilities in two WordPress plugins – Ninja Forms – File Upload (CVE-2026-0740, CVSS score: 9.8) and Breeze Cache (CVE-2026-3844, CVSS score: 9.8) – to upload arbitrary files to susceptible sites, which result in arbitrary code execution and complete takeover.
Unknown attackers have also been linked to a global campaign targeting internet-exposed, Modbus-enabled programmable logic controllers (PLCs) from September to November 2025 that spanned 70 countries and 14,426 distinct targeted IPs, most of which are located in the U.S., France, Japan, Canada, and India. A subset of these requests has been found to emanate from sources geolocated to China.
"The activity blended large-scale automated probing with more selective patterns that suggest deeper device fingerprinting, disruption attempts, and potential manipulation paths when PLCs are reachable from the public internet," Cato Networks researchers said. "Many source IPs had low or zero public reputation scores, consistent with fresh or rotating scanning hosts."
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2026/04/lmdeploy-cve-2026-33626-flaw-exploited.html