Testimonials Widget EUVD-2026-87541

No special conditions - remote unauthenticated exploitation against default configurations of the Testimonials Widget WordPress plugin (versions through 4.0.4). Exploitation requires only that the site exposes the plugin's URL-fetch feature; no authentication (PR:N), no user interaction (UI:N), and no non-default settings are needed. The practical value of the attack depends on the presence of reachable internal services (cloud metadata endpoints, internal admin panels, other intranet hosts) from the WordPress server's network position; because the fetched response is stored as a public file, the SSRF is fully readable rather than blind. Limiting factor: impact is confidentiality-only (no integrity or availability effect) and disclosure is scoped to whatever internal responses the server can reach.

This is a genuine but moderate-severity issue. The CVSS 3.1 vector (5.8, AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N) confirms fully remote, unauthenticated exploitation with low complexity and no user interaction - the easiest attacker preconditions possible - and the scope change (S:C) reflects that the SSRF reaches internal systems beyond the vulnerable WordPress host. However, impact is confidentiality-only and rated Low, so this is not a critical flaw despite trivial exploitability. Corroborating signals point to low real-world urgency: EPSS is 0.14% (3rd percentile), there is no CISA KEV listing, and the SSVC decision framework returns exploitation=none. The one signal that raises attention is SSVC automatable=yes combined with publicly available POC code from WPScan - meaning it can be reliably reconnaissance-scanned and reflected-SSRF read at scale, so opportunistic mass scanning is plausible even though there is no evidence of active exploitation. Net: a real but lower-tier priority (patch in normal cycle), not a high-CVSS-but-fictional-risk item; the value comes from unauth internal-network reconnaissance/data exposure rather than direct compromise. No conflicting data across sources; note that C:L may modestly understate impact since the fetched response is stored as a PUBLIC file, making internal-service responses fully readable rather than blind.

An unauthenticated attacker submits a request to the plugin supplying a URL pointing at an internal-only resource (e.g., http://169.254.169.254/ cloud metadata or an internal admin service). The server fetches that URL without validation and saves the response as a publicly accessible file, letting the attacker retrieve the internal service's response directly. Public POC code from WPScan exists, and the low-complexity unauthenticated vector (AV:N/AC:L/PR:N) makes this reliably reproducible.