Builderius CVE-2026-27350

The CVE description provides no specific feature, protocol, or configuration prerequisite - it states only that Builderius is vulnerable to SSRF across versions 1.4 through 1.4-beta. Per the supplied CVSS vector (PR:N/UI:N/AC:L), no authentication or user interaction is claimed and complexity is low, implying exploitation against a site simply running the affected plugin version; however, the exact vulnerable endpoint/parameter is not disclosed in the provided data and should be confirmed via the Patchstack advisory. Limiting factors: the attack targets only installations of this specific niche plugin at the affected versions, impact is scope-changed but low-confidentiality/low-integrity (not full compromise), and the unauthenticated claim (PR:N) is unverified - many comparable WordPress plugin SSRFs in practice require authenticated access, which would narrow the realistic attacker set.

The input CVSS v3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N, base 7.2 HIGH) describes a network-reachable, unauthenticated, low-complexity SSRF with a scope change and limited confidentiality/integrity impact - consistent with CWE-918. However, several high-value signals are MISSING: no EPSS probability, no CISA KEV entry, and no public proof-of-concept are present in the provided data, so exploitation likelihood cannot be quantified. There is no SSVC decision data supplied. The single source is a Patchstack advisory, which is a reputable WordPress-vulnerability feed but is the only corroborating reference. One point of tension to verify: Patchstack-class WordPress plugin SSRFs frequently require at least authenticated (contributor/author) access in practice, yet the supplied vector asserts PR:N (unauthenticated) - this should be confirmed against the Patchstack advisory detail, as it materially changes risk. Net assessment: a genuinely meaningful server-side flaw worth patching, but in the absence of EPSS/KEV/POC it reads as a moderate, not emergency, priority - elevated mainly by the unauthenticated-network claim rather than by any evidence of real-world exploitation.

A remote attacker sends a crafted request to a vulnerable Builderius endpoint on a WordPress site, supplying an attacker-controlled URL that the plugin fetches server-side. This lets the attacker coerce the server into contacting internal services or cloud metadata endpoints, with limited data returned to the attacker. No public exploit code has been identified at time of analysis.