The plugin contains an unsafe hostname validation that allows an attacker with Author or higher privileges to trigger HTTP requests to arbitrary hosts from the server. This Server‑Side Request Forgery can be used to read or modify data from internal services, leading to potential confidentiality and integrity violations. The flaw arises from using strpos for substring detection rather than strict host comparison, a classic input‑validation weakness identified as CWE‑918.

Database: WordPress plugin Responsive Lightbox & Gallery. All releases up to and including 2.7.1 are affected. The vulnerability can be exploited only by users with Author role or higher, so any site that has author‑level accounts is susceptible. Upgraded or patched versions after 2.7.1 are not impacted.

The CVSS score of 5 indicates moderate severity, and the EPSS score of less than 1% suggests a low likelihood of automated exploitation at this time. The vulnerability is not listed in the CISA KEV catalog, implying no known widespread active exploitation. However, attackers who can elevate to author privileges or are already authenticated can manually craft a request to supply an arbitrary URL, making the attack feasible in targeted environments. The primary attack vector is an authenticated host‑side request, relying on internal WordPress authorization to submit the malicious URL to the vulnerable endpoint.