Complianz CVE-2026-65496

Exploitation requires an authenticated session with WordPress Author-level privileges or higher on the target site (PR:H per CVSS vector). This means the attacker must either possess a legitimate Author (or Editor/Administrator) account, have compromised such credentials, or exploit a registration flow that permits Author-level self-signup. The AC:H metric indicates additional complexity beyond simply holding the required role - likely a specific plugin endpoint, parameter name, or request format must be identified and correctly crafted. Exploitation is limited by: (1) the requirement for Author-level authentication, ruling out unauthenticated or subscriber-level attackers; (2) high attack complexity suggesting non-trivial technical prerequisites; (3) impact confined to low confidentiality and integrity - there is no availability impact (A:N). Deployments that restrict Author account creation to vetted users face substantially reduced risk.

The provided CVSS score of 4.4 (Medium) reflects the compounding effect of high attack complexity (AC:H) and high privilege requirement (PR:H), which together significantly reduce real-world exploitability despite the network attack vector (AV:N) and scope change (S:C). EPSS data is not supplied, but the combination of PR:H and AC:H strongly implies low automated exploitation probability. No CISA KEV listing and no public POC are identified, further confirming this is not an actively exploited vulnerability at time of analysis. The 'Author' designation in the vulnerability title aligns with Patchstack's convention of assigning PR:H to WordPress roles at or above Author level, meaning exploitation is gated behind obtaining a non-trivial account on the target WordPress site. Confidentiality and integrity impacts are both Low (C:L/I:L), indicating limited data exposure or manipulation - consistent with SSRF used primarily for internal network reconnaissance rather than direct data exfiltration or code execution. Real-world risk is low for most deployments unless the WordPress site allows author-level self-registration or an adversary has already compromised an author account.

An attacker who has obtained or registered a WordPress Author-level account on the target site crafts a malicious request to the vulnerable Complianz plugin endpoint, supplying a URL pointing to an internal network resource (e.g., a metadata service or internal API at 169.254.169.254 or 192.168.x.x). The server processes the request and issues an HTTP call to the attacker-specified destination, potentially returning response data and confirming the existence of internal services. No public exploit code exists at time of analysis, and the high-complexity requirement suggests specific parameter knowledge or conditions are needed to reliably trigger the SSRF.