EUVD-2026-32702
GHSA-hq3c-7r96-pf8g
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature validation is insufficient because the signature is embedded in publicly-accessible JavaScript and the salt is static per site, allowing attackers to extract valid signatures. The favicon downloader uses raw cURL functions without any SSRF protection mechanisms (no localhost blocking, no private network filtering, and does not use WordPress's wp_safe_remote_* functions). This makes it possible for unauthenticated attackers to inject malicious referrer domains into the database and trigger server-side requests to arbitrary hosts including internal services.
AnalysisAI
Server-Side Request Forgery in Independent Analytics (WordPress plugin, all versions through 2.14.9) enables unauthenticated remote attackers to inject arbitrary referrer domains into the site's analytics database and subsequently trigger server-side HTTP requests to any host - including internal network services and cloud metadata endpoints. The exploit chain combines a bypassable signature check on the public /wp-json/iawp/search REST endpoint (static salt embedded in publicly-accessible JavaScript) with a scheduled favicon fetcher that issues raw cURL requests with zero SSRF mitigations. No public exploit is identified at time of analysis and the vulnerability is not listed in CISA KEV, but CVSS PR:N/AC:L indicates exploitation requires no authentication and minimal complexity, particularly threatening for WordPress deployments on cloud infrastructure.
Technical ContextAI
CWE-918 (Server-Side Request Forgery) manifests here through two cooperating components. First, IAWP/REST_API.php line 409 exposes a public /wp-json/iawp/search endpoint that accepts attacker-controlled referrer_url parameters gated by a signature - but the signature is derivable because the salt is static per site and the signing logic is embedded in frontend JavaScript visible to any visitor. Second, IAWP/FetchFaviconsJob.php line 27 schedules a WordPress cron task that calls IAWP/Favicon/FaviconDownloader.php line 57 using raw PHP cURL (not WordPress core's wp_safe_remote_get or wp_safe_remote_post). WordPress's safe remote functions enforce an allowlist that blocks loopback (127.0.0.1) and private RFC-1918 addresses; raw cURL has no such constraints. The affected CPE is cpe:2.3:a:bensibley:independent_analytics_-_wordpress_analytics_plugin:*:*:*:*:*:*:*:*, confirming the vulnerability spans the entire release history through 2.14.9 and was present at least as far back as version 2.14.4 per tagged trac references.
RemediationAI
An upstream fix has been committed to the plugin trunk as changeset 3537814@independent-analytics (per WordPress plugin trac), but the specific released patched version number is not confirmed from available input data - update the plugin to the latest version available via WordPress.org and verify the installed version exceeds 2.14.9. Until patching is complete, restrict unauthenticated access to the /wp-json/iawp/search endpoint via server-level rules (nginx: deny access in a location block for that specific route; Apache: use mod_rewrite to return 403 for matching REST paths) - note this will break legitimate referrer tracking functionality. Apply egress firewall rules on the web server host to block outbound HTTP/HTTPS connections to RFC-1918 private address ranges and link-local addresses (169.254.0.0/16), preventing SSRF from reaching internal services even if injection succeeds. For cloud deployments, enforce IMDSv2 (requiring a PUT token hop before metadata access) on AWS instances, which limits metadata SSRF even without egress filtering. Full Wordfence threat intelligence is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/06ecc40c-6a63-4354-9f49-1925896622f5.
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Country State City Dropdown CF7 plugin for WordPress is vulnerable to SQL Injection via the ‘cnt’ and 'sid' paramete
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today