CVE-2026-6089 in WP CTA Plugin
Summary
by MITRE • 07/29/2026
The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 07/29/2026
The WP CTA plugin for WordPress presents a critical server-side request forgery vulnerability that affects all versions up to and including 2.1.2, creating a significant security risk for WordPress installations. This vulnerability stems from insufficient input validation within the import_sidebars() function, which processes user-supplied data from imported JSON files containing sidebar configurations. The flaw specifically manifests when the 'sticky_s_media' parameter contains URLs that are passed directly to file_get_contents() without proper sanitization or network access restrictions, despite the presence of FILTER_VALIDATE_URL validation that fails to block internal IP address ranges.
The technical exploitation of this vulnerability requires an authenticated attacker with Administrator-level privileges or higher, as the import functionality is restricted to privileged users within the WordPress administration interface. This authentication requirement significantly reduces the attack surface compared to publicly exploitable vulnerabilities but does not eliminate the serious implications for compromised administrative accounts. The vulnerability allows attackers to initiate web requests from the web application server to any location, including internal network services that would normally be protected by firewalls or network segmentation policies, effectively bypassing traditional network security controls.
The operational impact of this SSRF vulnerability extends far beyond simple information disclosure, as it enables full-read capabilities through the media attachment creation process. When attacker-controlled URLs are processed through file_get_contents(), the response content is automatically saved as a WordPress media attachment within the target system, creating a persistent record of the successful attack. This mechanism transforms what might otherwise be a transient data exfiltration attempt into a more permanent and traceable security incident that can be used for further reconnaissance or as evidence of compromise.
The vulnerability maps directly to CWE-918 Server-Side Request Forgery and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, where attackers leverage application-level protocols to perform unauthorized network requests. This particular implementation bypasses standard network security controls by using the legitimate web server as an intermediary, making detection more difficult and potentially allowing for lateral movement within internal networks. The attack vector is particularly dangerous because it leverages the trust relationship between the WordPress application and internal services, potentially enabling access to sensitive data stored in databases or other internal resources that are not directly exposed to external network traffic.
Organizations should immediately update their WP CTA plugin installations to versions beyond 2.1.2 to remediate this vulnerability, as no effective workarounds exist for the core issue. The solution requires careful monitoring of imported JSON files and implementation of more robust URL validation mechanisms that specifically block internal IP address ranges, including private network addresses such as 10.x.x.x, 172.16.x.x through 172.31.x.x, and 192.168.x.x ranges. Additionally, implementing network segmentation controls and restricting outbound connections from the web server can help mitigate the impact of potential exploitation attempts, while maintaining proper access controls and regular security audits to detect unauthorized import activities that might indicate compromise.