Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authorization and URL validation on the image-proxy REST API endpoint. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-1294 Server-Side Request Forgery in WordPress All In One Image Viewer Block Plugin https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-1294
Post summary
The text announces CVE‑2026‑1294 as a Server‑Side Request Forgery flaw in the WordPress All In One Image Viewer Block Plugin, providing only the vulnerability type without any PoC, exploit code, patch, or active exploitation details.
CVE-2026-1294 The All In One Image Viewer Block plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.2 due to missing authoriza… https://www.cve.org/CVERecord?id=CVE-2026-1294
Post summary
CVE‑2026‑1294 exposes a server‑side request forgery flaw in the WordPress All In One Image Viewer Block plugin up to version 1.0.2 caused by missing authorization checks.