CVE-2026-14939CWE-918ssrf

CVE-2026-14939

Medium · published August 4, 2026

CVSS v3.1

6.8

EPSS

Percentile

30.5

In the wild

Unconfirmed

What it is

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

The record

Technical detail

CVSS v3.1: 6.8 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00377 · 30.5th percentile
Weakness: CWE-918 · Server-Side Request Forgery (SSRF)
Published: 2026-08-04T11:16Z

References (1)

https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb/ · [email protected]

EPSS history

Timeline

04 AUG 06:00Z
Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import
cvelistv5