Medium severity · published Feb 12, 2026
CVE-2026-1356
Converter for Media – Optimize images | Convert WebP & AVIF <= 6.5.1 - Unauthenticated Server-Side Request Forgery via src
4.8
CVSS
0.3%
EPSS
No
On KEV
Description
The Converter for Media – Optimize images | Convert WebP & AVIF plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.5.1 via the PassthruLoader::load_image_source function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 17% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CF
Converter for Media – Optimize images | Convert WebP & AVIF · mateuszgbiorczyk
through 6.5.1 · source: vendor
Affected product
CF
Converter for Media – Optimize images | Convert WebP & AVIF
mateuszgbiorczyk
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1356
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3445904/webp-converter-for-media
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/188d812c-2955-4b0c-ae1c-b42c0f60b73b?source=cve
More from Converter for Media – Optimize images | Convert WebP & AVIF
4.3
CVE-2025-13750
Converter for Media <= 6.3.2 - Missing Authorization to Authenticated (Subscriber+) Optimized Image Deletion via regenerate-attachment REST Endpoint