CVE-2026-16600

Name of the Vulnerable Software and Affected Versions SmartAIPress versions prior to 1.2.1

Description Users with subscriber-level access and above can perform a full-read Server-Side Request Forgery (SSRF), a condition where an attacker forces a server to make requests to an unintended location. This occurs because the plugin fails to perform a capability check on an AJAX action and does not validate a user-supplied URL before fetching it server-side. The issue is associated with the smartaipress openai upload and set featured image function.

Recommendations Update SmartAIPress to a version newer than 1.2.0. As a temporary mitigation, restrict access to the smartaipress openai upload and set featured image function for users with subscriber-level permissions.