CVE-2026-127217
Post to Google My Business WordPress Plugin < 3.5.7 SSRF via Preview REST Route
Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability that allows authenticated users with Contributor-level privileges or higher to make the server send requests to arbitrary hosts by supplying an unvalidated mbp_post_attachment URL that reaches a raw getimagesize() call in validate_external_image_size() via the preview REST route. Attackers can exploit this to perform internal port scanning, probe internal-only services and cloud metadata endpoints, and trigger GET-based side effects on internal systems, bypassing network perimeter controls since the request originates from the web server.
| CWE | CWE-918 |
| Vendor | koen reus |
| Product | post to google my business (google business profile) |
| Published | Nov 13, 2026 |
Get instant alerts for koen reus post to google my business (google business profile)
Be the first to know when new medium vulnerabilities affecting koen reus post to google my business (google business profile) are published — delivered to Slack, Telegram or Discord.
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N