CVE-2026-14939

MediumCVSS 6.8

Published: 04/08/2026(UTC)Updated: 26/08/2026(UTC)Translated: 05/08/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.23%

13th percentile - higher than 13% of all known CVEs

Summary

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Risk Assessment

An attacker with Contributor privileges can obtain IAM credentials from cloud instance metadata, potentially leading to full cloud account takeover and data breach.

Recommendation

Upgrade the Visualizer plugin to version 4.0.6 or later, which fixes this vulnerability.

Other vulnerabilities in Visualizer WordPress plugin

CVE-2026-86779Low
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-object ownership verification. This allows users with the Contributor role and above to permanently delete any chart on the site, including charts created by other users such as administrators.

Original NVD description (English source)

Vulnerability data from NVD (NIST) · CISA KEV · EPSS