CVE-2026-40500 processwire CVE debrief

Who should care

Administrators and security teams responsible for ProcessWire CMS installations should be aware of this vulnerability. Given the medium CVSS score of 6.1, organizations using affected versions should prioritize patching to prevent potential exploitation.

Technical summary

The vulnerability is caused by the 'Add Module From URL' feature in the ProcessWire CMS admin panel. Authenticated administrators can provide arbitrary URLs, leading to outbound HTTP requests to attacker-controlled hosts. This can result in internal network port scanning, host enumeration, and potential access to cloud instance metadata. The CVSS:4.0 vector is AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X.

Defensive priority

Medium priority should be given to patching this vulnerability, as it allows for potential reconnaissance and exploitation of internal networks.

Recommended defensive actions

• Apply patches or updates to ProcessWire CMS versions 3.0.255 and prior.
• Restrict access to the 'Add Module From URL' feature in the admin panel.
• Monitor server logs for suspicious outbound HTTP requests.
• Implement additional security measures such as web application firewalls (WAFs) to detect and prevent exploitation attempts.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-04-15T22:17:22.377Z and last modified on 2026-07-07T19:16:51.380Z. The NVD entry is currently Deferred. Limited details are available about the specific affected versions and scope of exploitation.

Official resources