CVE-2026-83543: Greenshift < 13.2.0 - Contributor+ SSRF via get-csv-to-json REST Endpoint

Q: Who can exploit this issue?

A user with contributor-level access or higher in the affected WordPress plugin can exploit it. Unauthenticated users are not identified as able to exploit it by the available information.

Q: What access does an attacker need to use the vulnerable endpoint?

The attacker needs an account with at least the Contributor role and the ability to supply a URL to the get-csv-to-json REST endpoint. The vulnerable plugin then fetches that URL from the server.

Q: What can a successful attacker do?

They can cause the server to send requests to arbitrary hosts and read the responses. This may expose resources reachable by the server that are not directly reachable by the attacker.

Published Sep 5, 2026

Updated

The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.

Affected Software

1 affected component

Greenshift Greenshift WordPress plugin<13.2.0

Event History

Sep 5, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

A user with contributor-level access or higher in the affected WordPress plugin can exploit it. Unauthenticated users are not identified as able to exploit it by the available information.

What access does an attacker need to use the vulnerable endpoint?

The attacker needs an account with at least the Contributor role and the ability to supply a URL to the get-csv-to-json REST endpoint. The vulnerable plugin then fetches that URL from the server.

What can a successful attacker do?

They can cause the server to send requests to arbitrary hosts and read the responses. This may expose resources reachable by the server that are not directly reachable by the attacker.