CVE-2026-96533 The Testimonials Widget WordPress plugin through 4.0.4… — CVE Notify

CVE Notify@cvenotify · 19.6K subscribers Open in TelegramOpen

🚨 CVE-2026-96533
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

🎖@cveNotify

WPScan

Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

See details on Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL CVE 2026-96533. View the latest Plugin Vulnerabilities on WPScan.