Instant Images <= 5.2- Auth. Server-Side Request Forgery (SSRF) vulnerability

@johnamp Should be fixed in the latest version, however, I’m waiting for the security researcher to get to me to confirm from PatchStack.

Same Problem here with version 5.2.0.1. Should be fixed in the latest version. But latest public version is still 5.2.0.1.

Not sure what you mean @besselink

There is now public version 5.2.0.2 available. But the Plugin is in Plesk and Patchstack still vulnerable.

Is there anything I can do here?

waiting for response from patchstack, please

Thanks for the quick response.

Version 5.2.0.2 is vulnerable: https://patchstack.com/database/vulnerability/instant-images/wordpress-instant-images-5-1-0-1-auth-server-side-request-forgery-ssrf-vulnerability

Fix it, please.

@besselink trust me I’d like to. Patchstack stopped responding to my email enquiries so I don’t know what else needs to be fixed.

it says in the report they have contacted me but it is false.

• This reply was modified 1 year, 8 months ago by Darren Cooney.

Hmmm…WPScan is not finding any vulnerabilities.

Maybe this can help you: https://shieldfy.io/security-wiki/server-side-request-forgery/server-side-request-forgery/

In Plesk the admin can set following inside the panel.ini to turn off vulnerability scan:

[ext-wp-toolkit]
vulnerabilityFeature = false

I love this plugin and teach it to all my WordPress students.

Here is what WPengine told me that it’s still a problem

https://wpscan.com/vulnerability/bb23bf9c-b0f2-441f-819c-aece423d61a1

I would love to see this cleared up.

thanks for making an awesome plugin!

• This reply was modified 1 year, 8 months ago by Christina Hills. Reason: I forgot to mention something

This is getting interesting… WP Engine just sent around an automated email about the Vulnerability.

At this time, we are not seeing that the plugin author has released an update or patch for this vulnerability. WP Engine has attempted to reach out to the plugin author to request the timing of a patch. We will report back to you if/when we receive a timeframe for when the author expects to release one.

They absolutely have not contacted me. And PatchStack won’t respond either.

@besselink Update: PatchStack responded… they are going to look into it and get back to me asap.