CVE-2026-16600

The SmartAIPress WordPress plugin through 1.2.0 does not perform a capability check on one of its AJAX actions and does not validate a user-supplied URL before fetching it server-side, allowing users with subscriber-level access and above to make the site retrieve arbitrary internal or external URLs and read the response, resulting in a full-read Server-Side Request Forgery.

CVSS v3.1

7.7 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

EPSS

0.20% chance of exploitation in the next 30 days, 10th percentile

Published

2026-08-29

Updated

2026-08-30

Proof-of-concept exploits (1)

• https://wpscan.com/vulnerability/66d2dc2d-fe77-4d34-bfca-d47b086a9c96/

References

• CVE Record
• NVD entry

Related

• CVE-2026-1660
• CVE-2026-16602
• CVE-2026-16595
• CVE-2026-16603
• CVE-2026-16594
• CVE-2026-16604