Benjamin Aguayo

**Name of the Vulnerable Software and Affected Versions** SmartAIPress versions prior to 1.2.1 **Description** Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery (SSRF), a condition where an attacker forces a server to make requests to an unintended location. This occurs because the plugin fails to perform a capability check on an AJAX action and does not validate a user-supplied URL before fetching it server-side. The issue is associated with the `smartaipress openai upload and set featured image` function. **Recommendations** Update SmartAIPress to a version newer than 1.2.0. As a temporary mitigation, restrict access to the `smartaipress openai upload and set featured image` function for users with subscriber-level permissions.