CVE-2026-96533

MediumCVSS 5.8

Published: 26/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file. This allows unauthenticated users to make the server issue requests to internal services and read the responses.

Risk Assessment

An attacker can use the server as a proxy to scan the internal network, access internal resources, or perform SSRF attacks.

Recommendation

Update the plugin to the latest version. Additionally, restrict access to the URL fetching functionality and implement allowlists and URL validation.

Other vulnerabilities in Testimonials Widget

CVE-2026-96532High
The Testimonials Widget WordPress plugin through 4.0.4 does not perform a capability or ownership check when handling its front-end testimonial submission form. This allows unauthenticated users to modify or create arbitrary posts, including overwriting the title, content and author of any existing post.

Original NVD description (English source)

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS