Is there a public PoC exploit available for CVE-2026-40500?

Yes, a public proof-of-concept exploit is available for CVE-2026-40500. Prioritise patching immediately. EPSS: 0.0%.

ProcessWire CVE-2026-40500

Q: What is the CVSS score of CVE-2026-40500?

CVE-2026-40500 has a CVSS 4.0 base score of 6.1 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23121 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-15 VulnCheck

GHSA-gmwr-9j4p-96vm

SSRF Processwire

6.1

CVSS 4.0 · Vendor: VulnCheck

Severity by source

Vendor (VulnCheck) PRIMARY

6.1 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

4.1 MEDIUM

Requires admin privileges (PR:H), network attack vector, low complexity, scope change to internal network.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (VulnCheck).

CVSS VectorVendor: VulnCheck

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 15:05 vuln.today

PoC Detected

May 01, 2026 - 14:41 vuln.today

Public exploit code

CVSS changed

Apr 15, 2026 - 22:22 NVD

6.8 (MEDIUM) 6.1 (MEDIUM)

EUVD ID Assigned

Apr 15, 2026 - 22:00 euvd

EUVD-2026-23121

CVE Published

Apr 15, 2026 - 21:25 nvd

MEDIUM 6.1

DescriptionCVE.org

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

AnalysisAI

Server-side request forgery in ProcessWire CMS 3.0.255 and prior allows authenticated administrators to abuse the 'Add Module From URL' feature to issue outbound HTTP requests to arbitrary internal or external hosts. This enables internal network reconnaissance, port scanning, and potential access to cloud metadata endpoints. A public exploit exists but requires admin credentials, limiting real-world risk.

Technical ContextAI

The vulnerability is a Server-Side Request Forgery (SSRF) classified as CWE-918, affecting ProcessWire CMS. The flaw resides in the admin panel's 'Add Module From URL' functionality, which lets administrators download modules from arbitrary URLs. The server does not validate or restrict the target host, allowing it to make requests to internal RFC-1918 addresses or cloud metadata services. The CPE cpe:2.3:a:processwire:processwire:*:*:*:*:*:*:*:covers all versions up to and including 3.0.255. SSRF attacks exploit the server's trust to bypass network segmentation and access internal resources.

RemediationAI

Upgrade ProcessWire to version 3.0.256 or later, which includes a fix for this SSRF issue. As a workaround, restrict outbound HTTP access from the server or disable the 'Add Module From URL' feature for non-essential administrators. No specific patch advisory from ProcessWire was found, but upgrading to the latest stable version should resolve the vulnerability. Refer to the VulnCheck advisory for additional guidance.