The Visualizer WordPress plugin versions prior to 4.0.6 do not validate or restrict user-supplied URLs before fetching them server-side. This lack of validation allows authenticated users with Contributor-level permissions or above to exploit a Server-Side Request Forgery (SSRF) vulnerability. The SSRF targets link-local instance metadata endpoints commonly used in cloud environments to expose instance metadata and credentials. Because the server returns the fetched response directly, attackers can retrieve sensitive cloud instance metadata, including IAM credentials, through this vulnerability. No CVSS score or official remediation level is currently available, and no patch links have been provided.

Exploitation of this vulnerability can lead to unauthorized disclosure of sensitive cloud instance metadata, including IAM credentials, on cloud-hosted sites using the vulnerable Visualizer plugin. This can result in privilege escalation and further compromise of cloud resources. The vulnerability requires at least Contributor-level access to the WordPress site, limiting exploitation to authenticated users with some level of trust. There is no indication of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level and higher user permissions to trusted users only. Monitor for updates from the Visualizer plugin vendor regarding patches or official mitigations.