CVE-2026-16600

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600

CVE-2026-16600 affects the SmartAIPress WordPress plugin through 1.2.0 . The root cause is a missing capability check on the AJAX action smartaipress_openai_upload_and_set_featured_image, combined with the absence of URL validation before a server-side fetch. This allows any user with subscriber-...

EUVD-2026-68043

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

CVE-2026-16600 SmartAIPress <= 1.2.0 - Subscriber+ Server-Side Request Forgery via smartaipress_openai_upload_and_set_featured_image

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external...

PT-2026-83395

Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1 Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery SSRF, a condition where an attacker forces a server to make requests to an unintended location...