Auto Upload Images

Auto Upload Images has 4 disclosed vulnerabilities in the WordSec catalog, reported between 2022 and 2026; all 4 are fixed as of October 2026. Their average CVSS score is 6.8, and the most serious one scores 8.8 out of 10. Severity breakdown: 0 critical and 1 high. 2022 was the busiest year with 2 disclosures.

The most common weakness is Server-Side Request Forgery (SSRF), behind 2 of the records (50%). Other recurring categories include Cross-Site Request Forgery (CSRF), Cross-Site Scripting.

Every one of the 4 issues recorded for Auto Upload Images has a vendor fix available, so running the current release closes all known holes.

3 independent researchers contributed these findings, most of them (2) reported by Rasi Afeef. Auto Upload Images is installed on roughly 20,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.3.

Strategic Overview

Avg CVSSMedium

6.8/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all Auto Upload Images vulnerabilities before they are exploited.

Highest severity on recordCVSS 8.8CVE-2022-42880

Auto Upload Images <= 3.3 - Cross-Site Request Forgery

Read the full analysis

Vulnerability Records

4 records


2026-09-17 00:00	Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery via 'src' Attribute of <img> Tags Auto Upload Images <= 3.3.2	`CVE-2026-12106`	6.4 Medium	Scc2	Yes
2025-06-19 00:00	Auto Upload Images <= 3.3.2 - Authenticated (Contributor+) Server-Side Request Forgery Auto Upload Images <= 3.3.2	`CVE-2025-49985`	6.4 Medium	ch4r0n	Yes
2022-10-24 00:00	Auto Upload Images <= 3.3 - Cross-Site Request Forgery Auto Upload Images <= 3.3	`CVE-2022-42880`	8.8 High	Rasi Afeef	Yes
2022-10-24 00:00	Auto Upload Images <= 3.3 - Authenticated (Admin+) Stored Cross-Site Scripting Auto Upload Images <= 3.3	`N/A`	5.5 Medium	Rasi Afeef	Yes

Showing 1–4 of 4 reports

Latestv3.4.1

Auto Upload Images

Author

Ali Irani

4.3(106)

86/100

Last Updated

2026-09-20 (1mo ago)

Active Installs

20,000+

Downloads

362,332

Requires WP

5.0+

Requires PHP

Tested up to

WP 7.1.3

Created

2012-11-13 (14y ago)

When you want to save a post, this plugin search for image urls which exists in post and automatically upload and import external images to the WordPress upload directory and add images to the media library and then replace new image urls with old urls. Features Automatically find images in posts and save them to the your server and wp media library Update posts with new image urls in your server Add images saved by plugin to the WordPress media library Process image urls inside selected custom fields, in addition to the post content Select custom post types for excluding auto upload images Choose exclude domain to save images from this domain address Choose custom your base url for images Choose custom images file name with patterns Choose custom image alt name with patterns Choose max width and height for images uploaded Protect your site from SSRF attacks: private and reserved IP addresses, cloud metadata endpoints and non-HTTP protocols are blocked, redirects are re-validated Translators English Persian (fa_IR) – Ali Irani Español (es) – Diego Herrera Russian (ru_RU) – Артём Рябков German (de_DE) – Till Zimmermann French (fr_FR) – Malaiac Korean (ko_KR) – Shodan Italian (it_IT) – Patryk Chmura Links Official Plugin Page Github Repository Report Issues

View on WordPress.org