CVE-2026-14939

MediumCVSS 6.8/10Last modified Aug 26, 2026

Description

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Metrics

CVSS 3.1 6.8/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Aug 4, 2026
Last modified: Aug 26, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-149405.3A heap-buffer-overflow flaw was found in 389 Directory Server (389-ds-base). When normalizing a Distinguished Name (DN) that contains a lega CVE-2026-149415.4The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related CVE-2026-149437.5The Password Protected — Lock Entire Site, Pages, Posts, Categories, and Partial Content WordPress plugin before 2.8.4 does not restrict RES CVE-2026-149467.2A high privileged remote attacker can upload a .php file and then request it directly from /uploads/<filename>.php to achieve arbitrary code CVE-2026-149477.2A high-privileged remote attacker can upload malicious ZIP archive containing directory traversal sequences such as ../ can escape the inten CVE-2026-149488.8A low privileged remote attacker can hijack an active administrative session without needing to know the administrator password by extractin CVE-2026-149496.5A low privileged remote attacker with a valid session can submit a request to the user creation functionality exposed through /api/user/add.CVE-2026-14956.5The vulnerability, if exploited, could allow an attacker with Event Log Reader (S-1-5-32-573) privileges to obtain proxy details, including CVE-2026-149509.8An unauthenticated remote attacker in possession of a valid session identifier is able to continue using the session after it should have ex CVE-2026-149518.0An low privileged remote attacker can cause authenticated users to perform unintended actions in the FDS Web interface using malicious web p CVE-2026-149527.5An unauthenticated remote attacker can retrieve sensible files from the FDS Web server, such as the backup archive at /FdsBackup.zip and add CVE-2026-149534.3A low-privileged remote attacker can enumerate all configured users and identify which accounts hold elevated privileges using the endpoint