CVE-2026-96533 — Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL

CVE-2026-96533

Testimonials Widget <= 4.0.4 - Unauthenticated SSRF via Featured Image URL PUBLISHED

Description (CNA)

The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.

Affected (CNA)

Vendor / product	Versions
Unknown / Testimonials Widget	affected 0 through 4.0.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/062284b2-b55d-42e2-8dda-ced7845d7df0/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.