CVE-2026-5737
Server-Side Request Forgery in Independent Analytics WordPress Plugin
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| independent_analytics | independent_analytics_plugin | to 2.14.9 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The Independent Analytics plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 2.14.9. This occurs because the plugin has a public tracking route (/wp-json/iawp/search) that accepts attacker-controlled referrer_url values when a signature matches. However, the signature validation is weak since the signature is embedded in publicly accessible JavaScript and the salt used is static per site, allowing attackers to extract valid signatures.
Additionally, the plugin includes a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains without any SSRF protections such as localhost blocking or private network filtering. This means unauthenticated attackers can inject malicious referrer domains into the database and cause the server to make requests to arbitrary hosts, including internal services.
How can this vulnerability impact me? :
This vulnerability can allow unauthenticated attackers to make the server perform requests to arbitrary hosts, including internal network services that are normally inaccessible from outside. This can lead to information disclosure, unauthorized access to internal resources, or further exploitation of internal services.
Because the attacker can inject malicious referrer domains and trigger server-side requests, it may also be possible to use this as a pivot point for additional attacks within the internal network.