The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users t…

Info

CVECVE-2026-96533

First seen2026-09-26 08:16 UTC

Disclosed2026-09-26 07:17 UTC

Last updated2026-09-26 08:16 UTC

Channel statusauto

Summary

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

In-depth triage

No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).

Sources

NVD DATABASE

Original Links

https://wpscan.com/vulnerability/062284b2-b55d-42e2-8dda-ced7845d7df0/

Timeline

2026-09-26 nvd_ingest NVD