CVE-2026-5737 is a Server-Side Request Forgery vulnerability in the Independent Analytics WordPress plugin (up to version 2.14.9). The vulnerability stems from a public API route (/wp-json/iawp/search) that accepts referrer_url parameters validated by a signature embedded in publicly accessible JavaScript, with a static salt per site. This weak signature validation allows attackers to obtain valid signatures and inject malicious referrer domains into the plugin's database. A scheduled favicon fetcher then performs unrestricted cURL requests to these stored domains without SSRF protections such as localhost blocking or private network filtering. This enables unauthenticated attackers to cause the server to make arbitrary HTTP requests, potentially targeting internal services or other unintended hosts. The vulnerability is rated medium severity with a CVSS 3.1 score of 6.5. No patch or official remediation has been disclosed as of the publication date.

An unauthenticated attacker can exploit this vulnerability to cause the server hosting the Independent Analytics plugin to make arbitrary HTTP requests to attacker-controlled or internal network hosts. This can lead to information disclosure or interaction with internal services that are not otherwise accessible externally. The impact is limited to confidentiality and integrity with no direct availability impact reported. The vulnerability does not require user interaction or privileges.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Independent Analytics plugin if possible. Monitoring for unusual outbound requests from the server may help detect exploitation attempts, but no specific mitigation is provided by the vendor at this time.