CVE-2026-96533 in Testimonials Widget Plugin
Summary
by MITRE • 09/26/2026
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
This vulnerability represents a critical Server-Side Request Forgery (SSRF) flaw within the Testimonials Widget plugin for WordPress, specifically affecting versions up through 4.0.4. The core technical deficiency lies in the application's failure to perform adequate validation or sanitization on user-supplied URL parameters before processing them server-side. When an administrator configures a testimonial source that involves fetching external content, the plugin accepts arbitrary URLs provided by the attacker without verifying their legitimacy or destination. This lack of input validation allows malicious actors to manipulate the request target, directing the web server to initiate HTTP requests toward internal network resources rather than public-facing internet services.
The operational impact of this SSRF vulnerability is severe due to its unauthenticated nature and the specific manner in which responses are handled. An attacker can exploit this flaw by crafting a POST or GET request that includes a malicious URL pointing to local host addresses, such as 127.0.0.1 or localhost, along with common internal ports like 80, 443, or service-specific ports for databases and management interfaces. Because the plugin stores the fetched response in a publicly accessible file location on the web server, it effectively creates an open proxy that leaks sensitive data from behind firewalls. This mechanism allows attackers to read responses from internal services, potentially exposing database credentials, configuration files, API keys, or other confidential information stored within the organization's private network infrastructure.
From a classification perspective, this vulnerability aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where web applications fetch remote resources without validating user-supplied URLs. Furthermore, it maps to MITRE ATT&CK technique T1571, specifically the Proxy component, as the vulnerable application is abused to relay requests and exfiltrate data from internal systems that are not directly accessible from the internet. The ability to store these responses in public files exacerbates the risk by providing a persistent mechanism for data theft, allowing attackers to retrieve sensitive information at their convenience rather than relying solely on real-time response parsing.
Mitigation strategies must focus on immediate remediation and long-term defensive hardening. Administrators should upgrade the Testimonials Widget plugin to version 4.0.5 or later, where this validation issue has been addressed by implementing strict allow-lists for permitted domains and protocols. In cases where upgrading is not immediately feasible, temporary mitigations include restricting outbound HTTP requests from the web server using firewall rules or network segmentation policies that block access to internal IP ranges. Additionally, developers should implement robust input validation techniques such as URL parsing to ensure only expected schemes like http and https are used, verify domain names against a whitelist of trusted sources, and disable any functionality that writes fetched content directly to publicly readable directories without proper authentication checks.