{"id":"CVE-2026-14939","aliases":["EUVD-2026-52588","GHSA-h5rr-p7mm-2q67"],"status":"published","title":"Visualizer: Tables and Charts Manager \u003c 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import","description":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.","severity":{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00377,"percentile":0.32074,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-918"],"published":"2026-08-04T06:00:10Z","modified":"2026-08-26T16:31:16Z","products":[{"vendor":"themeisle","product":"visualizer"},{"vendor":"unknown","product":"visualizer"}],"references":[{"url":"https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-14939"},{"url":"https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb"},{"url":"https://github.com/advisories/GHSA-h5rr-p7mm-2q67"}],"sources":{"cve":[{"id":"CVE-2026-14939","title":"Visualizer: Tables and Charts Manager \u003c 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import","description":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.","status":"published","published":"2026-08-04T06:00:10.414Z","modified":"2026-08-04T17:33:45.277Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T13:38:43.260938Z"}],"euvd":[{"id":"EUVD-2026-52588","description":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.","status":"published","published":"2026-08-04T06:00:10Z","modified":"2026-08-04T17:33:45Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T18:02:22.965583Z"}],"ghsa":[{"id":"GHSA-h5rr-p7mm-2q67","title":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe...","description":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.","status":"published","published":"2026-08-04T09:31:35Z","modified":"2026-08-04T18:31:25Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T15:10:05.423688Z"}],"nvd":[{"id":"CVE-2026-14939","description":"The Visualizer  WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.","status":"published","published":"2026-08-04T07:16:29.037Z","modified":"2026-08-26T16:31:16.753Z","cvss":[{"version":"3.1","score":6.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-918"],"updated_at":"2026-11-02T14:12:34.643497Z"}]}}