The All In One Image Viewer Block plugin for WordPress contains an unprotected image‑proxy REST endpoint that lacks proper authentication and URL validation. This flaw permits any user able to send HTTP requests to the site to instruct the server to retrieve data from arbitrary URLs, potentially including internal services. The vulnerability can be used to read or modify information from those services, leading to confidentiality or integrity compromise in a compromised environment.

WordPress sites that use the bplugins All In One Image Viewer Block through version 1.0.2 are affected. Versions 1.0.3 and later contain a fix that adds authorization and URL validation checks.

The flaw has a CVSS score of 7.2, indicating a high severity for attackers who can gain server‑side request capabilities. The EPSS score of less than one percent indicates a low but non‑zero exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the publicly exposed REST API endpoint from any location that can reach the web server, making the attack vector primarily network‑based and requiring no special privileges on the target system.