PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-5737 bensibley CVE debrief

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) in all versions up to and including 2.14.9. The vulnerability stems from a publicly accessible REST API endpoint at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when a signature validation check passes. The signature mechanism is insufficiently protected because the signature is embedded in publicly-accessible JavaScript and the salt remains static per site, enabling attackers to extract and forge valid signatures. Once malicious domains are injected into the database, a scheduled favicon fetcher job executes unrestricted cURL requests to these stored domains without implementing SSRF protections—specifically lacking localhost blocking, private network filtering, or use of WordPress's wp_safe_remote_* functions. This allows unauthenticated attackers to induce the server to make requests to arbitrary hosts, including internal services. The vulnerability was published on May 28, 2026, with a CVSS 3.1 score of 6.5 (Medium severity).

Vendor
bensibley
Product
Independent Analytics – WordPress Analytics Plugin
CVSS
MEDIUM 6.5
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-28
Original CVE updated
2026-05-28
Advisory published
2026-05-28
Advisory updated
2026-05-28

Who should care

WordPress site administrators using Independent Analytics plugin, security teams monitoring WordPress installations, hosting providers offering managed WordPress services, and organizations with internal services accessible from web server networks.

Technical summary

The vulnerability chain begins with signature extraction from public JavaScript, proceeds through forged requests to the /wp-json/iawp/search endpoint to inject malicious referrer domains, and culminates in server-side HTTP requests via the scheduled favicon fetcher's raw cURL implementation. The absence of SSRF protections in FaviconDownloader.php enables access to internal services and the metadata service on cloud-hosted WordPress installations.

Defensive priority

HIGH

Recommended defensive actions

  • Update Independent Analytics plugin to version 2.15.0 or later if available
  • Implement network egress filtering to restrict outbound connections from WordPress servers
  • Consider disabling the plugin until a patch is available if immediate update is not possible
  • Review server logs for suspicious outbound requests to internal IP ranges or unexpected domains
  • Apply WordPress hardening measures including restricting REST API access where functionality permits

Evidence notes

Source code analysis confirms the FaviconDownloader.php uses raw cURL functions without SSRF mitigations, and the REST_API.php endpoint at line 409 processes attacker-controlled referrer_url parameters. The signature validation weakness is documented in View.php where the static salt and client-side signature exposure enable forgery.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-5737 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-5737

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-5737 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-5737

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.