Cyber Resilience

CVE-2026-22482

Medium

Published: 22 January 2026

Published
22 January 2026
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 4.9 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
EPSS Score 0.0014 3.8th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-22482 is a medium-severity SSRF (CWE-918) vulnerability. Its CVSS base score is 4.9 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 3.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).

Deeper analysis

CVE-2026-22482 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, in the IMGspider WordPress plugin from wbolt.com. This issue affects all versions of IMGspider from n/a through 2.3.12, allowing SSRF attacks via the plugin's functionality.

The vulnerability has a CVSS v3.1 base score of 4.9 (AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N), indicating it can be exploited over the network by an attacker with low privileges, such as an authenticated WordPress user, under high attack complexity and without requiring user interaction. Successful exploitation enables limited confidentiality and integrity impacts within a changed scope, potentially allowing the attacker to trick the server into making unauthorized requests.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/imgspider/vulnerability/wordpress-imgspider-plugin-2-3-12-server-side-request-forgery-ssrf-vulnerability?_s_id=cve documents the SSRF vulnerability specifically in IMGspider version 2.3.12 for WordPress.

OWASP Top 10 for Web (2025)

A01:2025 Broken Access Control

EU & UK References

Vulnerability details

Server-Side Request Forgery (SSRF) vulnerability in wbolt.com IMGspider imgspider allows Server Side Request Forgery.This issue affects IMGspider: from n/a through <= 2.3.12.

CWE(s)
CWE-918

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SSRF in public-facing WordPress plugin directly enables exploitation of the application for initial access or internal requests.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2024-13195Shared CWE-918
CVE-2026-5052Shared CWE-918
CVE-2025-58045Shared CWE-918
CVE-2025-69299Shared CWE-918
CVE-2026-42398Shared CWE-918
CVE-2026-7025Shared CWE-918
CVE-2025-2691Shared CWE-918
CVE-2025-21385Shared CWE-918
CVE-2026-6625Shared CWE-918
CVE-2026-30118Shared CWE-918

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-4 Information Flow Enforcement good match
prevent

Enforces allowed information flows so the server cannot be tricked by plugin input into issuing arbitrary outbound requests to internal or external targets.

SI-10 Information Input Validation good match
prevent

Requires validation of URL and parameter inputs supplied to IMGspider, directly blocking the crafted requests that trigger SSRF.

SC-7 Boundary Protection partial match
prevent

Boundary-protection rules can restrict the plugin's outbound connections to only approved destinations, limiting SSRF reach.

References