CVE-2026-27350

Deferred Deferred - Pending Action

Server-Side Request Forgery in Builderius.io Builderius

Publication date: 2026-10-10

Last updated on: 2026-10-13

Assigner: Patchstack

Description

Server-Side Request Forgery (SSRF) vulnerability in Builderius.io Builderius allows Server Side Request Forgery. This issue affects Builderius: from 1.4 through 1.4-beta.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-10

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-11

EPSS Evaluated

2026-10-18

NVD

CVE-2026-27350

EUVD

EUVD-2026-96427

Affected Vendors & Products

Vendor	Product	Version / Range
Builderius.io	Builderius	1.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Builderius WordPress plugin affecting versions 1.4 and earlier. It allows unauthenticated attackers to force the server to make unauthorized internal network requests, potentially exposing sensitive data behind firewalls.

Detection Guidance

To detect this SSRF vulnerability in Builderius versions 1.4 through 1.4-beta, monitor network traffic for unusual outbound requests from the server to internal systems or unexpected external destinations. Check web server logs for suspicious connections originating from the plugin. Patchstack provides a mitigation rule to block attacks; implement it to detect exploitation attempts.

Impact Analysis

An attacker could exploit this to access internal systems, steal sensitive data, or perform unauthorized actions on your server. Since it requires no authentication, it poses a significant risk for data breaches or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized data exposure, violating GDPR and HIPAA requirements for data protection. Non-compliance may result in legal penalties, fines, or reputational damage due to potential data leaks.

Mitigation Strategies

Apply the mitigation rule provided by Patchstack to block SSRF attacks until an official patch is released. Update the Builderius plugin to the latest version if available. Seek assistance from a hosting provider or developer for further protection.

Hi! I’m here to help you understand CVE-2026-27350. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70