Description

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.8",
  "pubDate": "2026-09-26T07:17:03.630Z",
  "pubdate": "2026-09-26T07:17:03.630Z",
  "executiveSummary": "The Testimonials Widget WordPress plugin (through version 4.0.4) is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability exists due to insufficient validation of user-supplied URLs prior to processing by the server.\nAn unauthenticated attacker can exploit this flaw to force the WordPress server to initiate unauthorized HTTP requests to arbitrary internal or external network resources. By crafting malicious requests, an attacker can bypass perimeter security controls, probe internal infrastructure, or access sensitive data residing on the local network or the host environment.\nThe impact includes potential information disclosure, unauthorized interaction with internal services that lack authentication, and potential reconnaissance of the target infrastructure. The risk is significant as it requires no prior authentication, allowing any remote user to leverage the server as a proxy to interact with services otherwise shielded by the firewall. Remediation involves strictly validating and sanitizing all user-provided input and implementing strict allowlists for destination URLs.",
  "technicalDetails": "The vulnerability resides in the Testimonials Widget plugin's handling of user-supplied URL inputs. When the application processes these URLs, it fails to implement adequate server-side validation or sanitization. This allows an attacker to provide arbitrary URLs, which the application then requests using server-side resources.\nThe root cause is a lack of input validation and the absence of a restrictive allowlist mechanism for destination protocols and hostnames. By supplying an attacker-controlled URL, the underlying server-side code performs a fetch operation. Because the request originates from the server itself, it bypasses network-level restrictions, such as firewall rules or Access Control Lists (ACLs) that would normally prevent external access to internal network services.\nThe attack flow proceeds as follows: 1. The attacker identifies an entry point within the plugin that accepts a URL parameter for fetching external content. 2. The attacker submits a malicious request containing a crafted URL pointing to an internal resource (e.g., http://127.0.0.1:80/admin, http://169.254.169.254/latest/meta-data/, or other internal service endpoints). 3. The plugin, acting as a proxy, performs the HTTP request to the target destination using the web server's credentials and network context. 4. The server receives the response from the internal or external resource. 5. The application stores the response as a public file. 6. The attacker retrieves the response via the public URL generated by the plugin, resulting in sensitive information disclosure.\nThis vulnerability is particularly dangerous in cloud-hosted environments, where the metadata service (e.g., AWS, GCP, or Azure) can be queried via SSRF to exfiltrate IAM credentials or cloud instance configuration data. Furthermore, it allows for port scanning of the internal network, service discovery, and interaction with non-public administrative interfaces or databases that trust traffic originating from the local loopback interface.\nThe vulnerability affects all versions of the Testimonials Widget plugin up to and including 4.0.4. It requires no authentication and is remotely exploitable, making it a high-risk vector for malicious actors seeking to pivot into a protected internal environment."
}