CVE-2026-2479
SSRF Vulnerability in Responsive Lightbox & Gallery Plugin
Publication date: 2026-02-25
Last updated on: 2026-02-25
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| responsive_lightbox | responsive_lightbox | to 2.7.1 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Responsive Lightbox & Gallery plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 2.7.1.
This vulnerability arises because the plugin uses the PHP function strpos() for substring-based hostname validation instead of strict host comparison in the ajax_upload_image() function.
As a result, authenticated attackers with Author-level access or higher can make the web application send requests to arbitrary locations, potentially querying or modifying information from internal services.
How can this vulnerability impact me? :
This vulnerability allows an attacker with Author-level access or above to perform Server-Side Request Forgery (SSRF) attacks.
Such an attacker can make the web application send requests to arbitrary internal or external locations.
This can be used to query sensitive internal services or modify information within those services, potentially leading to unauthorized data access or manipulation.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The vulnerability involves Server-Side Request Forgery (SSRF) via the ajax_upload_image() function in the Responsive Lightbox & Gallery WordPress plugin, allowing authenticated users with Author-level access or higher to make arbitrary web requests from the server.
To detect exploitation attempts on your system or network, you can monitor for unusual outbound HTTP requests originating from your WordPress server, especially those triggered by authenticated users with Author or higher privileges.
Suggested commands include:
- Use web server access logs (e.g., Apache or Nginx) to search for requests to the ajax_upload_image AJAX endpoint, which may look like POST requests to admin-ajax.php with the action parameter set to rl_upload_image.
- Example command to search logs for suspicious ajax_upload_image calls: `grep 'action=rl_upload_image' /var/log/apache2/access.log`
- Monitor outgoing HTTP requests from the server using tools like tcpdump or Wireshark to detect unexpected requests to internal or external hosts.
- Example tcpdump command to capture HTTP traffic: `tcpdump -i eth0 -nn -s 0 -A port 80 or port 443` and filter for unusual destinations.
- Check WordPress user activity logs (if available) for actions performed by users with Author-level access or above that involve media uploads or AJAX calls.
What immediate steps should I take to mitigate this vulnerability?
The primary mitigation step is to update the Responsive Lightbox & Gallery WordPress plugin to version 2.7.2 or later, as this version includes fixes that address the SSRF vulnerability by improving hostname validation and other security measures.
Additional immediate steps include:
- Restrict Author-level and higher user permissions if possible, limiting who can upload images or perform AJAX actions related to media uploads.
- Implement network-level controls to restrict outbound HTTP requests from the WordPress server to only trusted hosts, preventing abuse of SSRF to access internal services.
- Monitor and audit logs for suspicious activity related to media uploads or AJAX requests to detect potential exploitation attempts.
- If immediate plugin update is not possible, consider temporarily disabling the Responsive Lightbox plugin or restricting access to its AJAX endpoints.