{"id":"CVE-2026-105967","kind":"vulnerability","aliases":["CVE-2026-105967"],"related":[],"title":"WordPress Gallery for Social Photo plugin: unauthenticated server-side request forgery","description":"The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.","summary":"The Gallery for Social Photo WordPress plugin through version 1.0.0.41 fetches a URL supplied by the user without checking it. An unauthenticated attacker can make the server request internal hosts and read the responses.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"feed-instagram-lite","fixed":["1.0.0.43"],"affected":"<= 1.0.0.41","ecosystem":"wordpress"}],"ecosystems":[],"tags":["package","self-hosted","ssrf","unauthenticated","wordpress"],"not_affected_if":["fixed-1.0.0.43","plugin-not-installed"],"how_to_check":"- WordPress admin > Plugins: find Gallery for Social Photo (folder feed-instagram-lite); version 1.0.0.41 or lower is vulnerable, 1.0.0.43 is the first release whose changelog lists the SSRF fix.\n- Or read the Version header in wp-content/plugins/feed-instagram-lite/ main plugin file.\n- The flaw is in the AJAX feed pagination endpoint via the next_url parameter (per the HOL/WPScan-derived record). If you cannot update, deactivate the plugin.","fix":"Update Gallery for Social Photo (slug feed-instagram-lite) to 1.0.0.43 or later; the maintainer's changelog lists 'Security SSRF issue in AJAX feed pagination endpoint' fixed there.","status":"open","published_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","triaged_at":"2026-11-03T06:20:50+00:00","updated_at":"2026-11-03T06:22:33+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T06:20:50Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Gallery for Social Photo plugin: unauthenticated server-side request forgery","impact":"medium","summary":"The Gallery for Social Photo WordPress plugin through version 1.0.0.41 fetches a URL supplied by the user without checking it. An unauthenticated attacker can make the server request internal hosts and read the responses.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker reaches internal services and reads their responses","analyst_note":"Check the NVD entry and the plugin's changelog for a fixed version and the vulnerable endpoint.","how_to_check":"- Check whether the plugin is installed and its version in the WordPress admin under Plugins, or in the plugin's main file header.\n- Look for a version at or below `1.0.0.41` as the vulnerable range.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Gallery for Social Photo WordPress plugin through version `1.0.0.41` are exposed, because the flaw is reachable without logging in. Sites that do not have the plugin installed are not affected. The sources do not say which request path or setting triggers the flaw.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00067,"input_tokens":4113,"output_tokens":518,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Check the NVD entry and the plugin's changelog for a fixed version and the vulnerable endpoint.","search":"'-105967':15A,18A '-2026':14A,17A '1.0.0.41':39B,72C 'allow':91C 'arbitrari':101C 'attack':52B,93C 'check':48B 'cve':13A,16A 'feed':20A 'feed-instagram-lite':19A 'fetch':40B 'forgeri':12A 'galleri':2A,31B,65C 'host':26B,59B,103C 'instagram':21A 'intern':58B,102C 'issu':98C 'lite':22A 'make':54B,95C 'packag':23B 'perform':85C 'photo':5A,34B,68C 'plugin':6A,36B,70C 'read':61B,105C 'request':11A,57B,90C,99C 'respons':63B,107C 'self':25B 'self-host':24B 'server':9A,56B,88C,97C 'server-sid':8A,87C 'side':10A,89C 'social':4A,33B,67C 'ssrf':27B 'suppli':43B,79C 'unauthent':7A,28B,51B,92C 'url':42B,80C 'use':82C 'user':46B,78C 'user-suppli':77C 'valid':75C 'version':38B 'without':47B 'wordpress':1A,29B,35B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Gallery for Social Photo WordPress plugin (feed-instagram-lite) at 1.0.0.41 or earlier are exposed, because the flaw can be triggered without logging in through the AJAX feed pagination endpoint (next_url parameter). The attacker can make the web server request internal hosts and read the responses, so hosts on cloud or internal networks matter most. Sites without the plugin, or on 1.0.0.43 or later, can skip it.","tier":"B","verified":{"fix":{"at":"2026-11-03T06:22:33Z","by":"analyst","doc":"https://wordpress.org/plugins/feed-instagram-lite/","run_id":1460}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["feedinstagramlite"],"ptokens":["feed","instagram","lite"],"labels":["high","package","selfhosted","ssrf","unauthenticated","wordpress"],"first_public_at":"2026-11-03T06:17:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105967","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105967","severity":null,"published_at":"2026-11-03T06:17:37+00:00","modified_at":"2026-11-03T06:17:37+00:00","first_seen_at":"2026-11-03T06:18:59+00:00","fetched_at":"2026-11-03T06:18:59+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105967:1460","url":null,"severity":null,"published_at":"2026-11-03T06:22:33+00:00","modified_at":"2026-11-03T06:22:33+00:00","first_seen_at":"2026-11-03T06:22:33+00:00","fetched_at":"2026-11-03T06:22:33+00:00","note":"Fix 1.0.0.43 read on maintainer's wordpress.org changelog (SSRF in AJAX feed pagination endpoint; changelog does not cite the CVE, match is by description). Endpoint param next_url from HOL record citing WPScan (not read directly). No exploitation or PoC found; X not checked (credits depleted per notes). NVD page returned empty."}],"documents":[{"id":55982,"url":"https://wordpress.org/plugins/feed-instagram-lite/","title":"Gallery for Social Photo changelog (wordpress.org)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":55983,"url":"https://hol.org/guard/security/cves/CVE-2026-105967-gallery-for-social-photo-10041-unauthenticated","title":"HOL Guard: Gallery for Social Photo <= 1.0.0.41 Unauthenticated SSRF via next_url","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}