CVE-2026-96533: Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

Q: Who can exploit this issue?

An attacker does not need to authenticate. They need to be able to submit a URL that the plugin will fetch as a featured image.

Q: What is the practical impact of a successful exploit?

The vulnerable plugin can be induced to send requests to internal services from the WordPress server. The fetched response may then be stored as a publicly accessible file, allowing the attacker to read it.

Q: Are default installations affected?

The provided information identifies the vulnerable behavior in the plugin through version 4.0.4, but does not state whether a particular default configuration exposes the URL submission path.

Published Sep 26, 2026

Updated

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

Affected Software

1 affected component

Testimonials Widget Testimonials Widget WordPress plugin<=4.0.4

Event History

Sep 26, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Who can exploit this issue?

An attacker does not need to authenticate. They need to be able to submit a URL that the plugin will fetch as a featured image.

What is the practical impact of a successful exploit?

The vulnerable plugin can be induced to send requests to internal services from the WordPress server. The fetched response may then be stored as a publicly accessible file, allowing the attacker to read it.

Are default installations affected?

The provided information identifies the vulnerable behavior in the plugin through version 4.0.4, but does not state whether a particular default configuration exposes the URL submission path.