CVE-2026-6089

Name of the Vulnerable Software and Affected Versions WP CTA versions prior to 2.1.3

Description An authenticated attacker with Administrator-level access or higher can perform a Server-Side Request Forgery (SSRF), a flaw where the server is tricked into making requests to an unintended location. This occurs because the import sidebars() function processes the sticky s media parameter within imported JSON files and passes the URLs to file get contents() using only FILTER VALIDATE URL validation, which fails to block internal IP addresses. This allows the attacker to make web requests to arbitrary internal locations to query or modify information from internal services, with the response content being saved as a WordPress media attachment.

Recommendations Update to a version newer than 2.1.2. Restrict the use of the sticky s media parameter in imported JSON files until the update is applied.