Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg <= 4.7.6 - Authenticated (Author+) Limited Server-Side Request Forgery via Image Sideload Endpoints
- ID
- WPSEC-2026-0182
- Plugin
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg (astra-sites)
- Affected
- all versions before 4.7.7
- Remediation
- Update to 4.7.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:N/A:N
- Weakness
- CWE-918
- Usage
- Plugin High · Affected versions Medium among sites WPSec scans, 2026-10-22
- Attack surface
- Starter Templates: AI-Powered Website Templates for Elementor & Gutenberg on WPSec AttackSurface
- Fix released
- Published
Description
The Starter Templates plugin for WordPress is vulnerable to limited Server-Side Request Forgery in all versions up to, and including, 4.7.6 via the image download AJAX handlers (astra-sites-create-image and the bundled ZipWP Images zipwp_images_insert_image action), which passed a user-supplied URL to download_url() without restricting the host. This makes it possible for authenticated attackers, with Author-level access and above (the upload_files capability), to make the web server send GET requests to arbitrary hosts and save any image returned to the media library. WordPress core's safe HTTP API still rejects loopback and private addresses and ports other than 80, 443 and 8080, and responses that are not valid images are discarded, so reaching internal services requires bypassing that check (for example via DNS rebinding) and non-image responses cannot be read.
References
- https://wpsec.com/vuln/WPSEC-2026-0182/
- https://plugins.svn.wordpress.org/astra-sites/tags/4.7.7/
- https://wordpress.org/plugins/astra-sites/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS