{"id":"CVE-2026-83543","title":"The Greenshift  WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the…","summary":"The Greenshift  WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the…","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","cwe":["CWE-918"],"published":"2026-09-05","updated":"2026-09-08","sourceUpdated":"2026-09-08T19:09:21.310","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-83543","references":[{"url":"https://wpscan.com/vulnerability/902e46ad-e577-4a3e-be19-a3bcc75ece77/","label":"contact@wpscan.com"}],"tags":["nvd"],"epss":0.00179,"epssPercentile":0.07684,"ingestedAt":"2026-09-06T05:50:39.389Z","slug":"CVE-2026-83543","body":"## Overview\n\nThe Greenshift  WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the response.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":8272,"id":"CVE-2026-83543","ts":1788919995286,"field":"cvss","old":null,"new":"4.1"},{"seq":8271,"id":"CVE-2026-83543","ts":1788919995286,"field":"severity","old":"none","new":"medium"},{"seq":8081,"id":"CVE-2026-83543","ts":1788919281111,"field":"cvss","old":"4.1","new":null},{"seq":8080,"id":"CVE-2026-83543","ts":1788919281111,"field":"severity","old":"medium","new":"none"},{"seq":7890,"id":"CVE-2026-83543","ts":1788916356385,"field":"cvss","old":null,"new":"4.1"},{"seq":7889,"id":"CVE-2026-83543","ts":1788916356385,"field":"severity","old":"none","new":"medium"},{"seq":7699,"id":"CVE-2026-83543","ts":1788915297811,"field":"cvss","old":"4.1","new":null},{"seq":7698,"id":"CVE-2026-83543","ts":1788915297811,"field":"severity","old":"medium","new":"none"},{"seq":7508,"id":"CVE-2026-83543","ts":1788912717009,"field":"cvss","old":null,"new":"4.1"},{"seq":7507,"id":"CVE-2026-83543","ts":1788912717009,"field":"severity","old":"none","new":"medium"},{"seq":7317,"id":"CVE-2026-83543","ts":1788911331759,"field":"cvss","old":"4.1","new":null},{"seq":7316,"id":"CVE-2026-83543","ts":1788911331759,"field":"severity","old":"medium","new":"none"},{"seq":7121,"id":"CVE-2026-83543","ts":1788909078647,"field":"cvss","old":null,"new":"4.1"},{"seq":7120,"id":"CVE-2026-83543","ts":1788909078647,"field":"severity","old":"none","new":"medium"},{"seq":6933,"id":"CVE-2026-83543","ts":1788907391839,"field":"cvss","old":"4.1","new":null},{"seq":6932,"id":"CVE-2026-83543","ts":1788907391839,"field":"severity","old":"medium","new":"none"},{"seq":6735,"id":"CVE-2026-83543","ts":1788905444585,"field":"cvss","old":null,"new":"4.1"},{"seq":6734,"id":"CVE-2026-83543","ts":1788905444585,"field":"severity","old":"none","new":"medium"},{"seq":6553,"id":"CVE-2026-83543","ts":1788903460052,"field":"cvss","old":"4.1","new":null},{"seq":6552,"id":"CVE-2026-83543","ts":1788903460052,"field":"severity","old":"medium","new":"none"},{"seq":6339,"id":"CVE-2026-83543","ts":1788901810902,"field":"cvss","old":null,"new":"4.1"},{"seq":6338,"id":"CVE-2026-83543","ts":1788901810902,"field":"severity","old":"none","new":"medium"},{"seq":6169,"id":"CVE-2026-83543","ts":1788899562443,"field":"cvss","old":"4.1","new":null},{"seq":6168,"id":"CVE-2026-83543","ts":1788899562443,"field":"severity","old":"medium","new":"none"},{"seq":6037,"id":"CVE-2026-83543","ts":1788898240511,"field":"cvss","old":null,"new":"4.1"},{"seq":6036,"id":"CVE-2026-83543","ts":1788898240511,"field":"severity","old":"none","new":"medium"}]}