EUVD-2026-125772

Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbppostattachment URL...

CVE-2026-127217

The Post to Google My Business plugin for WordPress (versions before 3.5.7 ) is vulnerable to a blind server-side request forgery (SSRF) . An authenticated user with Contributor-level privileges or higher can force the server to send requests to arbitrary hosts by providing an unvalidated mbp_pos...