---
id: "CVE-2026-105967"
kind: "vulnerability"
aliases: ["CVE-2026-105967"]
title: "WordPress Gallery for Social Photo plugin: unauthenticated server-side request forgery"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "feed-instagram-lite", "fixed": ["1.0.0.43"], "affected": "<= 1.0.0.41", "ecosystem": "wordpress"}]
ecosystems: []
tags: ["package", "self-hosted", "ssrf", "unauthenticated", "wordpress"]
not_affected_if: ["fixed-1.0.0.43", "plugin-not-installed"]
published_at: "2026-11-03T06:17:37+00:00"
first_seen_at: "2026-11-03T06:18:59+00:00"
updated_at: "2026-11-03T06:22:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105967", "first_seen_at": "2026-11-03T06:18:59+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-11-03T06:22:33+00:00"}]
---

# WordPress Gallery for Social Photo plugin: unauthenticated server-side request forgery

The Gallery for Social Photo WordPress plugin through version 1.0.0.41 fetches a URL supplied by the user without checking it. An unauthenticated attacker can make the server request internal hosts and read the responses.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:feed-instagram-lite affected <= 1.0.0.41 fixed 1.0.0.43

## How to check

- WordPress admin > Plugins: find Gallery for Social Photo (folder feed-instagram-lite); version 1.0.0.41 or lower is vulnerable, 1.0.0.43 is the first release whose changelog lists the SSRF fix.
- Or read the Version header in wp-content/plugins/feed-instagram-lite/ main plugin file.
- The flaw is in the AJAX feed pagination endpoint via the next_url parameter (per the HOL/WPScan-derived record). If you cannot update, deactivate the plugin.

## Fix

Update Gallery for Social Photo (slug feed-instagram-lite) to 1.0.0.43 or later; the maintainer's changelog lists 'Security SSRF issue in AJAX feed pagination endpoint' fixed there.

## Timeline

- 2026-11-03T06:18:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105967
- 2026-11-03T06:22:33+00:00 analyst — Fix 1.0.0.43 read on maintainer's wordpress.org changelog (SSRF in AJAX feed pagination endpoint; changelog does not cite the CVE, match is by description). Endpoint param next_url from HOL record citing WPScan (not read directly). No exploitation or PoC found; X not checked (credits depleted per notes). NVD page returned empty.

## Documents

- [describes] HOL Guard: Gallery for Social Photo <= 1.0.0.41 Unauthenticated SSRF via next_url https://hol.org/guard/security/cves/CVE-2026-105967-gallery-for-social-photo-10041-unauthenticated
- [fix] Gallery for Social Photo changelog (wordpress.org) https://wordpress.org/plugins/feed-instagram-lite/

## From the sources

The Gallery for Social Photo WordPress plugin through 1.0.0.41 does not validate a user-supplied URL before using it to perform a server-side request, allowing unauthenticated attackers to make the server issue requests to arbitrary internal hosts and read the responses.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_