6.8
Medium
CVE-2026-14939 The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before…
Description
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Visualizer 4.0 | earliest → < 4.0.6 | 4.0.6 |
Other CVEs of Visualizer
The 5 CVEs of Visualizer →
CVE-2026-86784
The Visualizer WordPress plugin before 4.0.8 does not sanitise and escape a chart's JSON data source configuration…
6.8
Medium
CVE-2026-86782
The Visualizer WordPress plugin before 4.0.6 does not properly authorise access to its chart-building actions, allowing…
5.5
Medium
CVE-2026-86779
The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a…
2.7
Low
CVE-2026-19726
The Visualizer WordPress plugin before 4.0.7 does not properly authorise access to the configuration of its charts,…
6.5
Medium