Description
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Published: 2025-11-19
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery (SSRF) enabling internal network access
Action: Immediate Patch
AI Analysis

Impact

The plugin contains a Server‑Side Request Forgery vulnerability that occurs when the function "get_image_size_by_url" processes user-supplied URLs without proper validation. An attacker who can authenticate with an Author-level role or higher can trigger the function to send arbitrary HTTP requests originating from the WordPress server. This can expose internal resources or allow modification of data exposed by those internal services, thereby compromising confidentiality and integrity within the network.

Affected Systems

Responsive Lightbox & Gallery plugin for WordPress, versions 2.5.3 and earlier are affected. Any site running these versions of the plugin is vulnerable.

Risk and Exploitability

The CVSS score of 5.4 indicates moderate severity, while an EPSS score of less than 1% reflects a low current exploitation probability. The vulnerability is not listed in CISA KEV. Exploitation requires the attacker to first obtain Author or higher privileges, after which they can craft requests to internal locations to retrieve or alter information.

Generated by OpenCVE AI on April 22, 2026 at 11:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the Responsive Lightbox & Gallery plugin to a version after 2.5.3.
  • Limit Author and higher role permissions so only trusted users can add or edit gallery items, or remove the author capability from publicly editable accounts.
  • Implement network or application-level firewall rules to block outbound requests from the WordPress instance to internal services, thereby mitigating SSRF exploitation.

Generated by OpenCVE AI on April 22, 2026 at 11:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Thu, 20 Nov 2025 10:45:00 +0000

Type Values Removed Values Added
First Time appeared Dfactory
Dfactory responsive Lightbox & Gallery
Wordpress
Wordpress wordpress
Vendors & Products Dfactory
Dfactory responsive Lightbox & Gallery
Wordpress
Wordpress wordpress

Wed, 19 Nov 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 19 Nov 2025 06:00:00 +0000

Type Values Removed Values Added
Description The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Title Responsive Lightbox & Gallery <= 2.5.3 - Authenticated (Author+) Server-Side Request Forgery
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'}

Subscriptions

Dfactory Responsive Lightbox & Gallery
Wordpress Wordpress
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T17:03:19.715Z

Reserved: 2025-10-27T16:13:08.985Z

Link: CVE-2025-12359

cve-icon Vulnrichment

Updated: 2025-11-19T20:32:07.771Z

cve-icon NVD

Status : Deferred

Published: 2025-11-19T06:15:45.890

Modified: 2026-04-15T00:35:42.020

Link: CVE-2025-12359

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T12:00:05Z

Weaknesses