TI-2026-12581 Aliases CVE-2026-14939 GHSA-h5rr-p7mm-2q67

Visualizer: Tables and Charts Manager < 4.0.6 - Contributor+ Server-Side Request Forgery via JSON Import

LOW 30CWE-918Published 2026-08-04 · Updated 2026-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-918 and the CVSS impact.

Summary

The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00377 31st percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by the CNA

Fix Fixed Visualizer (Unknown): 4.0.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Unknown	Visualizer	before 4.0.6	4.0.6	Patch available	CNA

Visualizer VendorUnknown Affected before 4.0.6 Fixed in 4.0.6 Patch available CNA

Remediation

Fix · CNA Visualizer (Unknown) Fixed in 4.0.6

Timeline

2026-10-02 Threatist record created from CVE-2026-14939
2026-10-03 Alias added: GHSA-h5rr-p7mm-2q67

References

Exploit 1

https://wpscan.com/vulnerability/b9a6211c-3173-4dd6-8a8d-32be248762bb/

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences