What is the CVSS score of CVE-2026-39670?

CVE-2026-39670 has a CVSS 3.1 base score of 6.0 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Visual Link Preview CVE-2026-39670

EUVD-2026-20346 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-08 Patchstack

GHSA-gfpr-2vcf-jmxj

SSRF Visual Link Preview

6.0

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

6.0 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20346

Analysis Generated

Apr 08, 2026 - 08:45 vuln.today

CVE Published

Apr 08, 2026 - 08:30 nvd

MEDIUM 6.0

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Brecht Visual Link Preview visual-link-preview allows Server Side Request Forgery.This issue affects Visual Link Preview: from n/a through <= 2.3.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in Brecht Visual Link Preview WordPress plugin versions through 2.3.0 allows authenticated attackers with low privileges to make arbitrary network requests from the affected server, potentially accessing internal resources, metadata services, or performing actions on behalf of the server. No public exploit code identified at time of analysis, though the vulnerability carries low real-world exploitation probability (EPSS 0.02%) despite moderate CVSS scoring.

Technical ContextAI

CWE-918 identifies SSRF vulnerabilities where an application fetches remote resources without properly validating user-supplied URLs. In Visual Link Preview (a WordPress plugin for generating link previews), the vulnerability likely resides in the preview-generation functionality that fetches and processes remote web content. The plugin fails to restrict which URLs can be accessed, enabling attackers to forge requests to internal services (localhost, private IP ranges, cloud metadata endpoints like AWS IMDSv1), or launch indirect attacks against third-party services. The WordPress plugin ecosystem's typical architecture makes this relevant to self-hosted WordPress installations using this component.

RemediationAI

Update Visual Link Preview to a version newer than 2.3.0 if available from the plugin developer. WordPress administrators should immediately deactivate and remove the plugin from affected installations until an updated version addressing CWE-918 SSRF validation is released. Implement network-level controls restricting outbound requests from WordPress to only necessary external services and block access to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost from the web server. Review the Patchstack vulnerability database (https://patchstack.com/database/Wordpress/Plugin/visual-link-preview/) and NIST CVE detail page (https://nvd.nist.gov/vuln/detail/CVE-2026-39670) for vendor patch announcements or alternative plugins.