CyberRota Analysis
AI-GeneratedThe Visualizer WordPress plugin prior to version 4.0.6 is vulnerable to Server-Side Request Forgery (SSRF) due to inadequate validation of user-supplied URLs, allowing users with Contributor-level access or higher to access sensitive link-local instance-metadata endpoints. This vulnerability can lead to the exposure of cloud instance metadata, including IAM credentials, making it critical for WordPress site administrators and developers using this plugin to prioritize an upgrade to mitigate potential data breaches.
Original NVD Description
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.