CVE-2026-6089 is a Server-Side Request Forgery vulnerability in the blendmedia WP CTA – Call Now Button, Sticky Button & Call to Action Builder WordPress plugin. The flaw exists in the import_sidebars() function, which processes the 'sticky_s_media' parameter from imported JSON files. It uses file_get_contents() on URLs validated only with FILTER_VALIDATE_URL, allowing internal IP addresses and thus SSRF. Authenticated attackers with Administrator privileges can exploit this to make arbitrary requests from the server, potentially accessing or modifying internal service data. The response content is stored as WordPress media attachments, constituting a full-read SSRF. This affects all versions up to and including 2.1.2.

An attacker with Administrator-level access can leverage this SSRF vulnerability to make arbitrary HTTP requests from the web server to internal or external systems. This can lead to unauthorized access to internal services and sensitive information disclosure. The vulnerability does not impact integrity or availability directly but has high confidentiality impact due to the full-read SSRF capability. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch is currently documented. Until a patch is available, restrict Administrator-level access to trusted users only and avoid importing JSON files from untrusted sources. Monitor vendor channels for updates regarding a fix.