CVE-2026-39521
MediumCVSS 4.9Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content allows Server Side Request Forgery. This issue affects Nelio Content from n/a through <= 4.3.1.
Risk Assessment
An attacker can make requests from the server to internal network resources, potentially leading to disclosure of sensitive data or further attacks on infrastructure.
Recommendation
Update the Nelio Content plugin to version 4.3.2 or later if available.
Other vulnerabilities in Nelio Content
See all- CVE-2026-94505High
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 due to improper verification of user permissions. This allows authenticated attackers with contributor-level access and above to permanently delete any reusable social message (nc_reusable_social post), including those authored by administrators or other privileged users.
- CVE-2026-57648Medium
The Nelio Content plugin for WordPress versions 4.3.4 and earlier contains a broken access control vulnerability for contributors. A user with the contributor role can gain unauthorized access to functions or data they should not have permissions for.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in Nelio Software Nelio Content nelio-content allows Server Side Request Forgery.This issue affects Nelio Content: from n/a through <= 4.3.1.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS