What the vulnerability does
01Description
The Responsive Lightbox & Gallery plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.3 via the 'get_image_size_by_url' function. This is due to insufficient validation of user-supplied URLs when determining image dimensions for gallery items. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
02Summary
Responsive Lightbox & Gallery versions 2.5.3 and earlier contain a server-side request forgery vulnerability. An authenticated attacker can make the plugin send HTTP requests to internal or external systems on the site's behalf, potentially accessing restricted resources or interacting with internal services. The vulnerability requires a valid user account but no additional user interaction.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal or external systems to access restricted resources or services.
Potential impact on your site
04Site Impact
An authenticated user can probe your internal network, access private APIs, or interact with backend services without authorization.
Conditions required to exploit
05Prerequisites
Attacker must have a valid user account with low privileges; no user interaction required.
Key dates
06Disclosure timeline
November 19, 2025
CVE published
April 8, 2026
Record updated
