PT-2026-107415

CVE-2026-97354

Published

2026-10-05

Updated

2026-10-07

Description by

CVSS 3.1

4.1

Medium

MetricsAV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PowerPress versions 11.13.12 through 11.17.10

Description An issue exists where the plugin fails to validate the destination of redirects when fetching a user-supplied media URL. This allows authenticated users with the contributor role and above to perform Server-Side Request Forgery (SSRF) attacks, which is a technique used to induce the server-side application to make requests to an unintended location. This can be used to query and modify information from internal services.

Recommendations Update to version 11.17.11.

Exploitability

Exploit

Fix

Impacts

Researchers

Raj Ukani

Vendors

Affected products

Weakness enumeration

CWE-918: Server-Side Request Forgery (SSRF)

Related identifiers