EUVD-2026-71858
GHSA-2737-p883-rmrx
Severity by source
AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Contributor-level WordPress access is PR:L not PR:H; S:C applies because SSRF reaches hosts outside the vulnerable component; C:L reflects response-reading only.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
5DescriptionCVE.org
The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.
AnalysisAI
Server-side request forgery in the Greenshift WordPress plugin before 13.2.0 allows contributor-level (and higher) authenticated users to direct the server to fetch arbitrary external or internal URLs and read the response. The flaw stems from missing URL validation before server-side HTTP requests are dispatched, enabling internal network reconnaissance, port scanning, or cloud instance metadata credential theft in hosted environments. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account with contributor role or higher - unauthenticated external attackers cannot directly exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor-reported CVSS score of 4.1 uses PR:H (high privilege required), but the description explicitly identifies contributor-level WordPress role as sufficient - a low-privilege role that can be registered freely on many sites. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Greenshift to version 13.2.0 or later, which is the vendor-released patch per the WPScan advisory (https://wpscan.com/vulnerability/902e46ad-e577-4a3e-be19-a3bcc75ece77/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Greenshift
View allStored cross-site scripting in the Greenshift WordPress plugin (all versions before 13.2.0) allows any user with Contrib
The Greenshift WordPress plugin before 5.0 does not validate and escape some of its block options before outputting them
The Greenshift - animation and page builder blocks plugin for WordPress is vulnerable to arbitrary file uploads due to m
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpsoul Greenshift
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wpsoul Gree
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today