Visualizer exposes cloud metadata through non-blind SSRF
Visualizer before 4.0.6 accepts a Contributor-supplied URL without excluding unsafe address ranges before fetching it from the WordPress server. The fetched response is returned to the caller, allowing a Contributor to query link-local cloud metadata endpoints and retrieve instance metadata, including IAM credentials when the hosting environment exposes them. The public advisory does not disclose the endpoint, URL parameter, request function or supported protocols.
- Component
- Visualizer
- Plugin slug
visualizer- Affected
- < 4.0.6
- Safe version
4.0.6- Published
- Aug 04, 2026
This CVE was published Aug 04, 2026 and is one of 16 known issues for this plugin.
Update, patch or deactivate.
Update Visualizer to 4.0.6 or later. Review requests by delegated authors and rotate cloud credentials if the WordPress host could reach an instance-metadata service while vulnerable.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Visualizer WordPress plugin before 4.0.6 does not restrict a user-supplied URL to safe address ranges before fetching it server-side, allowing users with Contributor-level access and above to perform Server-Side Request Forgery against link-local instance-metadata endpoints. As the fetched response is returned in the reply, the attack is non-blind, enabling retrieval of cloud instance metadata (including IAM credentials) on cloud-hosted sites.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N