CVE-2022-1037: EXMAGE < 1.0.7 - Admin+ Blind SSRF

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-18 · updated 2026-06-17
Weakness: CWE-918

Description

The EXMAGE WordPress plugin before 1.0.7 does to ensure that images added via URLs are external images, which could lead to a blind SSRF issue by using local URLs

Affected products

EXMAGE – WordPress Image Links: before 1.0.7 — fixed in 1.0.7

How to fix

Upgrade to a fixed version: EXMAGE – WordPress Image Links 1.0.7. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/bd8555bd-8086-41d0-a1f7-3557bc3af957
https://wpscan.com/vulnerability/bd8555bd-8086-41d0-a1f7-3557bc3af957

Get alerted when CVE-2022-1037 or the next vulnerability affects your stack