The Converter for Media – Optimize images | Convert WebP & AVIF plugin processes external image URLs through the PassthruLoader::load_image_source function without validating or restricting destinations. This design flaw allows an unauthenticated attacker to instruct the web application to issue HTTP requests to arbitrary internal or external endpoints, enabling read or write operations against internal services. The resulting impact includes unauthorized data exposure, potential modification of internal resources, and broader access to the server’s network without requiring user credentials.

WordPress sites that have installed the Converter for Media – Optimize images | Convert WebP & AVIF plugin version 6.5.1 or earlier.

The CVSS score of 4.8 indicates a moderate severity, while the EPSS score of less than 1% suggests a low current likelihood of exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. However, the flaw can be abused by unauthenticated actors who trigger the load function with a crafted source parameter, allowing them to send requests from the server to any reachable endpoint, including internal network services.