The Gallery for Social Photo WordPress plugin up to version 1.0.0.41 fails to validate the user supplied next_url parameter. An attacker can supply any URL, causing the server to perform a request to that location and return the response content. Because the plugin does not enforce authentication, any visitor to the site can trigger the request, providing read access to arbitrary internal resources and potentially disclosing sensitive data.

WordPress installations that have the Gallery for Social Photo plugin enabled and running version 1.0.0.41 or older are affected. No specific operating system or hosting environment is tied to the vulnerability; the attack surface is the plugin itself.

The vulnerability is trivial to exploit: no authentication is required and the attack path is a single HTTP request. EPSS is unavailable and the CVSS score is not reported, but the lack of controls and the ability to enumerate internal hosts make this a significant risk for any site with internal services. It is not listed in the CISA KEV catalog, yet the potential exposure of internal resources warrants immediate attention.