CVE-2026-96533
MEDIUM
NVD
CVSS Score
5.8
Severity
MEDIUM
Published
Sep 26, 2026
Vendor
unknown
Description
The Testimonials Widget WordPress plugin through 4.0.4 does not validate a user-supplied URL before fetching it server-side and storing the response as a public file, allowing unauthenticated users to make the server issue requests to internal services and read the responses.