Nelio Content CVE-2026-39521

The vulnerability is a classic Server-Side Request Forgery (CWE-918) flaw in the Nelio Content plugin for WordPress. SSRF vulnerabilities occur when application code constructs HTTP requests based on user-controlled input without proper validation, allowing attackers to forge requests that originate from the server itself rather than the attacker's machine. This is particularly dangerous in cloud and containerized environments where internal services (databases, metadata endpoints, API gateways) are often accessible only from the server. The Nelio Content plugin (WordPress plugin architecture, CPE: cpe:2.3:a:nelio_software:nelio_content) appears to have insufficient URL validation in a feature that constructs or proxies HTTP requests, permitting an authenticated user to supply a malicious URL that the server then fetches. The high attack complexity (AC:H) suggests the vulnerability requires specific conditions-such as knowledge of internal network topology or crafting of particular request types-rather than trivial exploitation.