medium5.8
CVE-2026-96533
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a publi…
Impact
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.
Affected products
| Product | Affected versions |
|---|---|
| Testimonials Widget WordPress Plugin | through 4.0.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.