PULSE
LIVE28signals / 24h
ES
FEED
ransomgunra reclama a worldtube · KR · Technologyransomqilin reclama a WD Masonry & Concrete · US · Otherransomakira reclama a University SprinklerSystems · Manufacturingransomorova reclama a Tat Fung Textile Co., Ltd. · HK · Manufacturingransomorova reclama a Integrated Site Management · US · Professional Servicesransomorova reclama a Conceptual Designs, Inc. · US · Otherransomorova reclama a JK Capital Management Limited · HK · Financial Servicesransomorova reclama a Global Friction Products, Inc · US · Manufacturingransomaurora reclama a GILDE Handwerk Macrander GmbH & Co. KG · DE · Manufacturingransomaurora reclama a US Installation Group, Inc. · US · Manufacturingransomincransom reclama a pushidrosal.id · ID · Otherransomincransom reclama a lccgroup.com · PH · Professional Servicesransomincransom reclama a https://geleximco.vn/ · VN · Manufacturingransomincransom reclama a clintonhealthaccess.org · US · Healthcareransomgunra reclama a worldtube · KR · Technologyransomqilin reclama a WD Masonry & Concrete · US · Otherransomakira reclama a University SprinklerSystems · Manufacturingransomorova reclama a Tat Fung Textile Co., Ltd. · HK · Manufacturingransomorova reclama a Integrated Site Management · US · Professional Servicesransomorova reclama a Conceptual Designs, Inc. · US · Otherransomorova reclama a JK Capital Management Limited · HK · Financial Servicesransomorova reclama a Global Friction Products, Inc · US · Manufacturingransomaurora reclama a GILDE Handwerk Macrander GmbH & Co. KG · DE · Manufacturingransomaurora reclama a US Installation Group, Inc. · US · Manufacturingransomincransom reclama a pushidrosal.id · ID · Otherransomincransom reclama a lccgroup.com · PH · Professional Servicesransomincransom reclama a https://geleximco.vn/ · VN · Manufacturingransomincransom reclama a clintonhealthaccess.org · US · Healthcare
← All CVEs
CVE WatchAug 4, 2026

CVE-2026-14939

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, a

CVSS

—

No CVSS

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Aug 4, 2026 · Last modified: Aug 4, 2026

EPSS · 30d

Not enough EPSS history yet.

Technical description

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Official references
Related CVEs

No related CVEs by CWE or product.