An unauthenticated Server-Side Request Forgery vulnerability in the All In One Image Viewer Block plugin allows remote attackers to perform unauthorized requests against internal services.

This is a Server-Side Request Forgery (CWE-918) vulnerability occurring in the image-proxy REST API endpoint. The flaw allows unauthenticated attackers to force the server to initiate requests to arbitrary locations, including internal network services.

The ability for an unauthenticated attacker to interact with internal infrastructure significantly increases the risk of unauthorized data exfiltration or the manipulation of internal service configurations. Given the CVSS score of 7.2, this vulnerability represents a high risk to business continuity and data integrity, as it provides a foothold for further lateral movement within the network.

Immediate Action: Update the All In One Image Viewer Block plugin to version 1.0.3 or later immediately to resolve the vulnerable endpoint.

Proactive Monitoring: Monitor server access logs for suspicious requests directed at internal IP addresses or unusual traffic patterns originating from the web server.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block unauthorized access to the REST API endpoint associated with the image-proxy functionality.

Public Exploit Available: No

Given the potential for internal network exposure, organizations using the All In One Image Viewer Block plugin must prioritize updating to version 1.0.3. Failure to patch allows attackers to bypass perimeter security and interact with internal assets that are otherwise unreachable from the public internet.