What is the CVSS score of CVE-2026-6089?

CVE-2026-6089 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.3%.

WP CTA CVE-2026-6089

EUVD-2026-50272 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-29 Wordfence

GHSA-7hj5-j6jm-q3vw

WordPress SSRF Wordpress Plugin Wp Cta Call Now Button Sticky Button Call To Action Builder

4.9

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

4.9 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

4.9 MEDIUM

Administrator credentials required (PR:H); file_get_contents is read-only so I:N; full response retrieval via media attachment warrants C:H.

3.1 AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 29, 2026 - 10:51 vuln.today

CVE Published

Jul 29, 2026 - 09:31 cve.org

MEDIUM 4.9

DescriptionCVE.org

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.

AnalysisAI

Full-read Server-Side Request Forgery in WP CTA - Call Now Button, Sticky Button & Call to Action Builder (WordPress plugin, versions through 2.1.2) allows authenticated WordPress administrators to direct the web server to fetch arbitrary internal or external URLs, with the full response content persisted as a WordPress media attachment and thus retrievable by the attacker. The root cause is the import_sidebars() function in inc/import-export.php passing the attacker-controlled sticky_s_media URL from an imported JSON file directly to PHP's file_get_contents(), relying solely on FILTER_VALIDATE_URL validation, which does not block RFC 1918 private address ranges or localhost. No public exploit identified at time of analysis; a patch commit exists in the plugin's WordPress.org SVN repository.

Technical ContextAI

The WP CTA plugin (WordPress.org slug: easy-sticky-sidebar, vendor: blendmedia; CPE: cpe:2.3:a:blendmedia:wp_cta_-_call_now_button,_sticky_button_&_call_to_action_builder:*:*:*:*:*:*:*:*) implements a sidebar configuration import/export feature. During JSON import, the import_sidebars() function (inc/import-export.php, line 97) extracts the sticky_s_media field and passes it to PHP's file_get_contents() to fetch remote media. The only gate is PHP's FILTER_VALIDATE_URL, which validates URL syntax but does not block internal destinations such as 127.0.0.1, 169.254.169.254 (cloud instance metadata), or RFC 1918 ranges (10.x, 172.16-31.x, 192.168.x). Because the fetched response is saved as a WordPress media attachment, the attacker can subsequently read the full server response - classifying this as a full-read SSRF (CWE-918: Server-Side Request Forgery). Vulnerable targets include any WordPress installation running this plugin on infrastructure where the web server process has access to internal network services.

RemediationAI

An upstream fix has been committed to the plugin's WordPress.org SVN repository per the changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3491924%40easy-sticky-sidebar%2Ftrunk&old=3459250%40easy-sticky-sidebar%2Ftrunk - however, the exact patched release version number is not independently confirmed from the available data; verify the current release on the WordPress.org plugin page and update to any version beyond 2.1.2. As compensating controls pending upgrade: restrict the WordPress Administrator role to fully trusted personnel only, since exploitation requires admin-level access; if the plugin's import/export feature is not actively used, disable or block access to the import endpoint via web server configuration (note: this may break sidebar migration workflows). Deploy egress firewall rules on the web server to block outbound HTTP/HTTPS requests to RFC 1918 ranges, loopback addresses, and the instance metadata endpoint (169.254.169.254), which limits SSRF blast radius without affecting plugin functionality in most deployments.