{"id":"CVE-2026-127217","kind":"vulnerability","aliases":["CVE-2026-127217"],"related":[],"title":"WordPress Post to Google My Business plugin: blind SSRF from contributor accounts","description":"Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.","summary":"The Post to Google My Business plugin for WordPress, before 3.5.7, lets an authenticated Contributor-level user make the server send requests to arbitrary hosts through an unvalidated image URL. An attacker can use this to scan internal networks, reach internal services and cloud metadata endpoints, and trigger GET requests on internal systems.","severity":"medium","cvss":6.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress"],"not_affected_if":["no-contributor-users","plugin-not-installed","version-3.5.7-or-later"],"how_to_check":"- Check whether the Post to Google My Business plugin is installed and its version in the WordPress admin plugin list, or in `wp-content/plugins/` on the server\n- Confirm the installed version is below `3.5.7`","fix":"- Post to Google My Business plugin for WordPress: `3.5.7` or later","status":"open","published_at":"2026-11-13T21:17:43+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","triaged_at":"2026-11-13T21:33:51+00:00","updated_at":"2026-11-13T21:33:51+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-13T21:33:51Z","model":"claude-haiku-5-5","output":{"fix":"- Post to Google My Business plugin for WordPress: `3.5.7` or later","reach":"network","title":"WordPress Post to Google My Business plugin: blind SSRF from contributor accounts","impact":"medium","summary":"The Post to Google My Business plugin for WordPress, before 3.5.7, lets an authenticated Contributor-level user make the server send requests to arbitrary hosts through an unvalidated image URL. An attacker can use this to scan internal networks, reach internal services and cloud metadata endpoints, and trigger GET requests on internal systems.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"server sends requests to internal hosts and cloud metadata","analyst_note":"","how_to_check":"- Check whether the Post to Google My Business plugin is installed and its version in the WordPress admin plugin list, or in `wp-content/plugins/` on the server\n- Confirm the installed version is below `3.5.7`\n- unknown whether other check methods are documented in the sources","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","version-3.5.7-or-later","no-contributor-users"],"who_is_affected":"Sites running the Post to Google My Business plugin for WordPress before 3.5.7 that let Contributor-level or higher users create content are exposed. The flaw sits in the preview REST route, so the server making outbound requests is the one that matters. Sites without this plugin, or with it at 3.5.7 or later, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000779,"input_tokens":4681,"output_tokens":621,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127217':15A,18A '-2026':14A,17A '3.5.7':34B,87C 'account':12A 'allow':98C 'arbitrari':48B,115C 'attach':123C 'attack':56B,141C 'authent':37B,99C 'base':163C 'blind':8A,90C 'busi':6A,29B,82C 'bypass':169C 'call':130C 'cloud':68B,156C 'contain':88C 'contributor':11A,39B,103C 'contributor-level':38B,102C 'control':172C 'cve':13A,16A 'effect':165C 'endpoint':70B,158C 'exploit':143C 'extern':133C 'forgeri':95C 'get':73B,162C 'get-bas':161C 'getimages':129C 'googl':4A,27B,80C 'higher':107C 'host':22B,49B,116C 'imag':53B,134C 'intern':62B,65B,76B,147C,152C,167C 'internal-on':151C 'let':35B 'level':40B,104C 'make':42B,109C 'mbp':121C 'metadata':69B,157C 'network':63B,170C 'origin':176C 'packag':19B 'perform':146C 'perimet':171C 'plugin':7A,30B,83C 'port':148C 'post':2A,25B,78C,122C 'preview':138C 'privileg':105C 'probe':150C 'raw':128C 'reach':64B,126C 'request':46B,74B,94C,113C,175C 'rest':139C 'rout':140C 'scan':61B,149C 'self':21B 'self-host':20B 'send':45B,112C 'server':44B,92C,111C,180C 'server-sid':91C 'servic':66B,154C 'side':93C,164C 'sinc':173C 'size':135C 'ssrf':9A 'suppli':118C 'system':77B,168C 'trigger':72B,160C 'unvalid':52B,120C 'url':54B,124C 'use':58B 'user':41B,100C 'valid':132C 'via':136C 'vulner':96C 'web':179C 'wordpress':1A,23B,32B,85C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Post to Google My Business plugin for WordPress before 3.5.7 that let Contributor-level or higher users create content are exposed. The flaw sits in the preview REST route, so the server making outbound requests is the one that matters. Sites without this plugin, or with it at 3.5.7 or later, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-127217':15A,18A '-2026':14A,17A 'account':12A 'blind':8A 'busi':6A 'contributor':11A 'cve':13A,16A 'googl':4A 'plugin':7A 'post':2A 'ssrf':9A 'wordpress':1A","search_b":"'3.5.7':34B 'arbitrari':48B 'attack':56B 'authent':37B 'busi':29B 'cloud':68B 'contributor':39B 'contributor-level':38B 'endpoint':70B 'get':73B 'googl':27B 'host':22B,49B 'imag':53B 'intern':62B,65B,76B 'let':35B 'level':40B 'make':42B 'metadata':69B 'network':63B 'packag':19B 'plugin':30B 'post':25B 'reach':64B 'request':46B,74B 'scan':61B 'self':21B 'self-host':20B 'send':45B 'server':44B 'servic':66B 'system':77B 'trigger':72B 'unvalid':52B 'url':54B 'use':58B 'user':41B 'wordpress':23B,32B","search_c":"'3.5.7':87C 'allow':98C 'arbitrari':115C 'attach':123C 'attack':141C 'authent':99C 'base':163C 'blind':90C 'busi':82C 'bypass':169C 'call':130C 'cloud':156C 'contain':88C 'contributor':103C 'contributor-level':102C 'control':172C 'effect':165C 'endpoint':158C 'exploit':143C 'extern':133C 'forgeri':95C 'get':162C 'get-bas':161C 'getimages':129C 'googl':80C 'higher':107C 'host':116C 'imag':134C 'intern':147C,152C,167C 'internal-on':151C 'level':104C 'make':109C 'mbp':121C 'metadata':157C 'network':170C 'origin':176C 'perform':146C 'perimet':171C 'plugin':83C 'port':148C 'post':78C,122C 'preview':138C 'privileg':105C 'probe':150C 'raw':128C 'reach':126C 'request':94C,113C,175C 'rest':139C 'rout':140C 'scan':149C 'send':112C 'server':92C,111C,180C 'server-sid':91C 'servic':154C 'side':93C,164C 'sinc':173C 'size':135C 'suppli':118C 'system':168C 'trigger':160C 'unvalid':120C 'url':124C 'user':100C 'valid':132C 'via':136C 'vulner':96C 'web':179C 'wordpress':85C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T21:17:43+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127217","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127217","severity":null,"published_at":"2026-11-13T21:17:43+00:00","modified_at":"2026-11-13T21:17:43+00:00","first_seen_at":"2026-11-13T21:33:40+00:00","fetched_at":"2026-11-13T21:33:40+00:00","note":null}],"documents":[{"id":150289,"url":"https://www.vulncheck.com/advisories/post-to-google-my-business-wordpress-plugin-ssrf-via-preview-rest-route","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}