Nelio Content EUVD-2026-20183

The vulnerability requires authenticated access to the WordPress site (user account with at least contributor/author privileges or above, consistent with PR:L in CVSS). Additionally, the attack depends on a specific Nelio Content feature or configuration that constructs HTTP requests based on user-supplied URLs without validating them against a whitelist or blocking internal IP ranges (127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254). The exact feature triggering the vulnerability is not detailed in available public references; users must examine the advisory and plugin code to identify which Nelio Content functionality is vulnerable.

Multiple risk signals converge on LOW real-world priority. The CVSS base score of 4.9 is below the severity threshold for many organizations, and the vector reveals critical constraints: authenticated access required (PR:L), high attack complexity (AC:H), and only confidentiality/integrity impact (no availability or privilege escalation). The EPSS score of 0.02% (4th percentile) is exceptionally low, indicating security analysts and threat intelligence platforms predict minimal likelihood of exploitation in the wild. The absence of a KEV entry, public exploit code, or weaponized POC further reduces priority. However, this should not be ignored: if the WordPress site is compromised or an attacker gains a low-privileged account (subscriber, contributor, author), they could probe internal networks, attack cloud metadata services, or access internal APIs. Organizations running Nelio Content should patch promptly during routine maintenance windows, but this does not warrant emergency incident response activation.

An authenticated WordPress contributor or low-privileged user with access to Nelio Content settings discovers a feature that accepts a URL parameter (e.g., for importing content, fetching feeds, or configuring external resources). The attacker crafts a malicious URL pointing to an internal service, such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or http://localhost:6379 (Redis cache). The server processes this URL and returns the response to the attacker, revealing credentials, API keys, or sensitive configuration data. Because the request originates from the trusted server, firewall and access control rules do not block it.