WP CTA CVE-2026-6089

Exploitation requires an authenticated WordPress user with Administrator-level privileges or higher - this is the primary limiting factor (CVSS PR:H). The attacker must use the plugin's sidebar import functionality by uploading or supplying a JSON file containing an attacker-controlled URL in the sticky_s_media field. The vulnerability is only triggerable when the WP CTA plugin (easy-sticky-sidebar) version 2.1.2 or earlier is installed and active on the WordPress site. SSRF reach is bounded by the web server process's outbound network access: installations behind strict egress firewalls that block internal IP ranges will see reduced impact. There is no requirement for any non-default WordPress configuration beyond having the plugin installed and active. User interaction beyond the attacker's own import action is not required.

The CVSS base score of 4.9 (Medium) is consistent with the PR:H constraint - exploitation is gated behind WordPress Administrator-level credentials, which substantially limits opportunistic or mass exploitation. The C:H impact reflects the full-read nature of the SSRF: the attacker receives and can store complete response bodies, enabling exfiltration of cloud metadata tokens (AWS IMDSv1 at 169.254.169.254), internal API responses, or service configuration data. No EPSS score was provided in the input, and the vulnerability is not listed in CISA KEV, meaning there is no confirmed evidence of active in-the-wild exploitation. No public POC has been identified at time of analysis. The primary real-world risk scenarios are: (1) a compromised administrator account used for post-compromise lateral movement to internal services; (2) an insider threat actor with legitimate admin access; (3) chained exploitation where admin access is obtained via a separate vulnerability. The CVSS S:U (Unchanged scope) rating is technically accurate per the framework, but practical SSRF impact to cloud metadata endpoints or internal services (Redis, Jenkins, Consul) can significantly exceed the base score suggests - a nuance defenders should weigh. CVSS and real-world risk are broadly aligned here; this is not a case of inflated severity.

An attacker with WordPress administrator credentials crafts a JSON sidebar configuration file in which the sticky_s_media field contains an internal URL such as http://169.254.169.254/latest/meta-data/iam/security-credentials/ (AWS IMDSv1) or http://localhost:8500/v1/kv/ (Consul). The attacker uploads this file via the plugin's sidebar import interface, causing the server to fetch the internal resource via file_get_contents() and save the response as a WordPress media attachment. The attacker then retrieves the attachment URL to read cloud IAM credentials or internal service data, enabling lateral movement or privilege escalation beyond the WordPress environment.