CVE-2026-6089

Received Received - Intake

Server-Side Request Forgery in WP CTA WordPress Plugin

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: Wordfence

Description

The WP CTA plugin for WordPress is vulnerable to Server-Side Request Forgery via the 'sticky_s_media' parameter in imported JSON files in all versions up to, and including, 2.1.2. This is due to the import_sidebars() function passing user-supplied URLs from imported JSON data to file_get_contents() with only FILTER_VALIDATE_URL validation (which allows internal IPs). This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services. The response content is saved as a WordPress media attachment, making this a full-read SSRF.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-6089

Affected Vendors & Products

Vendor	Product	Version / Range
wp_cta	wp_cta	to 2.1.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the WP CTA WordPress plugin versions up to 2.1.2. It occurs when the import_sidebars() function processes user-supplied URLs from imported JSON files via the sticky_s_media parameter. The function uses weak validation (FILTER_VALIDATE_URL) that allows internal IP addresses, enabling attackers with Administrator access to make arbitrary web requests from the server. The responses are saved as WordPress media attachments, making this a full-read SSRF attack.

Detection Guidance

This vulnerability requires checking WordPress installations for the WP CTA plugin versions up to 2.1.2. Inspect server logs for unusual outbound requests or media attachments from unknown internal sources. No specific commands are provided in the context.

Impact Analysis

An attacker with Administrator access could exploit this to access internal services, read sensitive data, or interact with internal systems. This could lead to data breaches, unauthorized information disclosure, or further attacks on internal infrastructure. The impact is limited to authenticated users with high privileges.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's safeguards for protected health information. Organizations using this plugin may face compliance violations, legal penalties, and reputational damage if exploited.

Mitigation Strategies

Immediately update the WP CTA plugin to the latest version beyond 2.1.2. If updating is not possible, disable the plugin until a patch is applied. Review and restrict Administrator-level access to reduce attack surface.

Hi! I’m here to help you understand CVE-2026-6089. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70