What is the CVSS score of CVE-2026-14939?

CVE-2026-14939 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.1%.

Is there a public PoC exploit available for CVE-2026-14939?

Yes, a public proof-of-concept exploit is available for CVE-2026-14939. Prioritise patching immediately. EPSS: 0.1%.

Is there a patch available for CVE-2026-14939?

Yes, a patch is available for CVE-2026-14939. Update the affected software to the latest version immediately.

Visualizer WordPress Plugin CVE-2026-14939

EUVD-2026-52588 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-04 WPScan

GHSA-h5rr-p7mm-2q67

WordPress SSRF Visualizer Unknown

6.8

CVSS 3.1 · Vendor: WPScan

Severity by source

Vendor (WPScan) PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

vuln.today AI

7.7 HIGH

Contributor is a low-privilege WordPress role (PR:L, not PR:H); scope changes to cloud metadata service; no integrity or availability impact observed.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (WPScan).

CVSS VectorVendor: WPScan

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 04, 2026 - 18:32 vuln.today

Patch available

Aug 04, 2026 - 07:01 EUVD

CVE Published

Aug 04, 2026 - 06:00 cve.org

UNKNOWN (no severity yet)

CVE Published

Aug 04, 2026 - 06:00 cve.org

MEDIUM 6.8

DescriptionCVE.org

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

AnalysisAI

Server-Side Request Forgery in the Visualizer WordPress plugin before 4.0.6 allows any authenticated Contributor-level user to pivot through the WordPress server and reach link-local instance-metadata endpoints (e.g., 169.254.169.254), returning the full response to the attacker. On cloud-hosted WordPress deployments (AWS, GCP, Azure), this enables non-blind exfiltration of IAM credentials and other instance metadata, potentially leading to full cloud account compromise. A publicly available proof-of-concept exploit exists; exploitation probability is currently low (EPSS 0.14%, 3rd percentile) but the concrete cloud-credential impact makes this a material priority for cloud-hosted sites.

Technical ContextAI

The vulnerability is rooted in CWE-918 (Server-Side Request Forgery), where the Visualizer plugin accepts a user-controlled URL and performs a server-side HTTP fetch without validating that the destination falls within safe, non-routable address ranges. The plugin then reflects the server's response back to the requesting user, making this a non-blind (full-read) SSRF - the most impactful class of SSRF. The targeted surface is the IMDS (Instance Metadata Service) accessible at the link-local address 169.254.169.254 on major cloud platforms, which returns IAM role tokens, access keys, and configuration details without any authentication. The affected product is identified by CPE cpe:2.3:a:unknown:visualizer:*:*:*:*:*:*:*:* covering all versions below 4.0.6. The vendor CPE namespace is listed as 'unknown,' indicating the plugin publisher has not yet been formally registered in the NVD CPE dictionary.

RemediationAI

Update the Visualizer WordPress plugin to version 4.0.6 or later immediately, as confirmed by the WPScan advisory (https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb/) and the NVD entry (https://nvd.nist.gov/vuln/detail/CVE-2026-14939). For sites that cannot patch immediately, the most effective compensating control on AWS is enabling IMDSv2 (Instance Metadata Service v2), which requires a PUT-based token exchange before metadata can be fetched - SSRF via a simple GET request cannot satisfy this requirement, blocking credential theft at the metadata layer without affecting other site functionality. On GCP, restricting the metadata server at the firewall level from web-server processes is an option but may break GCP agent functionality. Disabling public user registration ('Settings > General > Anyone can register') removes the lowest-friction path to obtaining a Contributor account, but does not protect against compromised or malicious registered users. Deploying a WAF rule to block outbound requests to 169.254.169.254 at the network perimeter addresses only the specific cloud-metadata vector and not general SSRF toward internal services.