CVE-2026-24639

MediumCVSS 4.4

Published: 23/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.21%

10th percentile - higher than 10% of all known CVEs

Summary

The Photo Block plugin versions up to 1.7.1 contain a Server-Side Request Forgery (SSRF) vulnerability, allowing authors to send requests to internal network resources.

Risk Assessment

The risk involves scanning internal networks, accessing sensitive services, or launching attacks on other internal systems.

Recommendation

Update the Photo Block plugin to a version above 1.7.1 that fixes this vulnerability.

Other vulnerabilities in Photo Block

CVE-2025-64254Low
The Photo Block plugin by Ronald Huereca up to version 1.5.1 has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects all versions from n/a through 1.5.1.

Original NVD description (English source)

Author Server Side Request Forgery (SSRF) in Photo Block <= 1.7.1 versions.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS