The Auto Save Remote Images (Drafts) plugin for WordPress contains a Server‑Side Request Forgery flaw in its fetch_images() function. An authenticated user with Contributor or higher access can supply arbitrary URLs for the plugin to retrieve on behalf of the server. The lack of input validation enables the attacker to target internal networks, enabling either reconnaissance or active modification of services behind the web application. This vulnerability maps to CWE‑918.

Any WordPress instance running the fernandiez Auto Save Remote Images (Drafts) plugin version 1.0.9 or earlier is affected. Sites that have upgraded beyond the 1.0.9 release are not vulnerable, but the exact patched version is not specified in the available data.

The CVSS score of 6.4 classifies the problem as moderate severity. The EPSS score of less than 1 % suggests a low probability of exploitation at this time, and the vulnerability is not listed in the CISA KEV catalog. However, because the flaw only requires a Contributor‑level login, any site that permits such users is at risk of internal system exposure if the server can reach internal IP ranges. The required skill level is low for an authenticated attacker, which increases the practical threat.