Visualizer WordPress Plugin CVE-2026-14939

Exploitation requires: (1) A WordPress installation running the Visualizer plugin in any version below 4.0.6. (2) The attacker must hold at minimum a Contributor-level WordPress account on the target site - exploitation cannot be performed unauthenticated. (3) The WordPress site must be hosted on a cloud platform (AWS EC2, GCP Compute Engine, Azure VM) with an accessible link-local instance metadata endpoint at 169.254.169.254; on-premises or bare-metal deployments lack this endpoint and the high-impact credential-theft path does not apply. Exploitation is limited by: the authenticated prerequisite (though Contributor is the lowest authoring role), the cloud-hosting dependency for maximum impact, and cloud providers that have enforced IMDSv2 exclusively (which blocks unauthenticated GET-based SSRF to the metadata service). Non-cloud deployments face a residual internal SSRF risk against other link-local or RFC-1918 services, but credential theft is not achievable.

The official CVSS score of 6.8 uses PR:H (high privileges), but the description explicitly states Contributor-level access is sufficient - a WordPress role granted to any registered author who cannot publish posts. This represents a significant discrepancy: PR:L is the more accurate metric, which would push the effective score to approximately 8.5 (High). The Scope:Changed metric is correctly applied, as the vulnerable component (the plugin) is leveraged to attack a separate system (the cloud metadata service). The EPSS score of 0.14% at the 3rd percentile suggests automated or widespread opportunistic exploitation has not yet materialized, but this is consistent with a plugin-specific vulnerability requiring an authenticated foothold. No CISA KEV listing is present; however, a publicly available proof-of-concept exploit is confirmed via the WPScan reference. The real-world risk profile is cloud-deployment-dependent: on bare-metal or self-hosted WordPress, SSRF to link-local addresses yields no cloud credentials and impact is minimal. On AWS, GCP, or Azure-hosted sites, successful exploitation hands an attacker rotatable IAM credentials with the EC2/GCE instance's attached role permissions - a severe secondary impact not fully reflected in the CVSS base score. Sites with open user registration amplify risk significantly by removing the need for the attacker to obtain a pre-existing Contributor account through social engineering.

An attacker registers a free Contributor account on a WordPress site where user registration is open, then crafts a plugin request directing the Visualizer plugin to fetch http://169.254.169.254/latest/meta-data/iam/security-credentials/. The plugin fetches the URL server-side and returns the raw JSON response - including the AWS IAM role name - to the attacker, who follows up with a second request to retrieve the full credentials (AccessKeyId, SecretAccessKey, Token). A public proof-of-concept is available that demonstrates this exact path.