CVE-2026-14939
6.8 MEDIUMPublished 2026-08-04 · Updated 2026-08-04
AI risk analysis
- Summary
- The flaw allows users with Contributor-level access or higher to perform Server-Side Request Forgery (SSRF) attacks, enabling them to retrieve sensitive cloud instance metadata, including IAM credentials.
- Exploitability
- Exploitation requires a user with at least Contributor-level access and knowledge of the target environment. The attack is non-blind, making it relatively straightforward once conditions are met.
- Blast radius
- If exploited, this could lead to unauthorized access to sensitive cloud metadata, potentially compromising the security of cloud-hosted WordPress sites.
- Prioritized remediation
- Update the Visualizer WordPress plugin to version 4.0.6 or higher to restrict user-supplied URLs and prevent SSRF attacks.
Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.
NVD description
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.