The Visualizer WordPress plugin versions prior to 4.0.6 do not properly restrict user-supplied URLs before fetching them server-side. This allows users with Contributor-level or higher privileges to perform Server-Side Request Forgery (CWE-918) attacks targeting link-local instance metadata endpoints. Because the server returns the fetched response in the reply, attackers can retrieve sensitive cloud instance metadata such as IAM credentials. This vulnerability has a CVSS 3.1 base score of 6.8, indicating a medium severity impact. No official patch or remediation level has been confirmed in the provided data.

An attacker with Contributor-level access or higher can exploit this vulnerability to retrieve sensitive cloud instance metadata, including IAM credentials, from link-local metadata endpoints. This could lead to unauthorized access to cloud resources. The vulnerability does not impact confidentiality of other data directly, nor does it affect integrity or availability beyond the metadata exposure. The attack requires authenticated user privileges at Contributor level or above.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level user privileges where possible and monitor for suspicious activity related to SSRF attempts. Avoid exposing sensitive metadata endpoints to the WordPress environment. Follow vendor updates for patches addressing this issue.