Scc2

**Name of the Vulnerable Software and Affected Versions** Auto Upload Images versions prior to 3.3.3 **Description** This issue is a Limited Server-Side Request Forgery (SSRF), a flaw that allows a server to be coerced into making requests to an unintended location. Authenticated attackers with contributor-level access or higher can initiate web requests to arbitrary locations from the web application. The flaw exists in the `downloadImage()` function because the plugin utilizes `wp remote get()` instead of `wp safe remote get()`. Additionally, the `validate()` method only rejects URLs matching the site's own hostname, failing to block requests to loopback, private, or link-local addresses such as `127.0.0.1`, `10.0.0.0/8`, or `169.254.169.254`. This can be triggered by embedding a crafted `<img>` tag with a `src` attribute pointing to internal network hosts within post content. **Recommendations** Update to a version newer than 3.3.2. As a temporary workaround, restrict the ability of users with contributor-level access to submit post content containing `<img>` tags until the update is applied.