CVE-2026-14939
Medium · 6.8CVSS
6.8
EPSS
0.4%
Published
Aug 4, 2026
CISA due date
—
The record
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63184 Refitter is a tool for generating a C# REST API client using the Refit library. CWE-918
- CVE-2026-119343 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-918
- CVE-2026-119342 Stirling-PDF is a locally hosted web application that facilitates various operations on… CWE-918
- CVE-2026-62284 OSAC operator is a Kubernetes operator. CWE-918
- CVE-2026-55598 PinePods is a complete, self-hosted podcast management system written in Rust. CWE-918
- CVE-2026-116252 pgAdmin 4's materialized view refresh passed the target database's name to psql's… CWE-918
- CVE-2026-61840 Quest Bot is an opensource Discord Bot. CWE-918
- CVE-2026-119712 PipesHub before 0.10.0 contains a server-side request forgery vulnerability in… CWE-918