Description
Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Koen Reus | Post to Google My Business (Google Business Profile) | < 3.5.7 | 3.5.7 |
References
- WordPress Changelog release-notes patch
- VulnCheck Advisory: Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route third-party-advisory