The Greenshift WordPress plugin before 13.2.0 does not validate a user-supplied URL before fetching it server-side, allowing users with contributor-level access and above to make the server issue requests to arbitrary hosts and read the…

1. Sep 5, 2026Published

   Disclosed via NVD

2. Sep 6, 2026EPSS first tracked

   0.1%

3. Sep 7, 2026EPSS peak

   0.1% → 0.2%

4. Sep 8, 2026Record revised

   Last analysed / modified upstream

5. Sep 8, 2026CVSS changed

   4.1 → —

6. Sep 8, 2026Severity changed

   medium → none

7. Sep 9, 2026CVSS changed

   — → 4.1

8. Sep 9, 2026Severity changed

   none → medium

9. Sep 9, 2026CVSS changed

   4.1 → —

10. Sep 9, 2026Severity changed

    medium → none

11. Sep 9, 2026CVSS changed

    — → 4.1

12. Sep 9, 2026Severity changed

    none → medium

13. Sep 9, 2026CVSS changed

    4.1 → —

14. Sep 9, 2026Severity changed

    medium → none

15. Sep 9, 2026CVSS changed

    — → 4.1

16. Sep 9, 2026Severity changed

    none → medium

Change history

Field changes observed since this record was first indexed.

• Sep 9, 2026CVSS — → 4.1
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 4.1 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 4.1
• Sep 9, 2026Severity none → medium
• Sep 9, 2026CVSS 4.1 → —
• Sep 9, 2026Severity medium → none
• Sep 9, 2026CVSS — → 4.1
• Sep 9, 2026Severity none → medium
• Sep 8, 2026CVSS 4.1 → —
• Sep 8, 2026Severity medium → none