CVE-2026-5737

Vulnerability

The Independent Analytics plugin for WordPress versions up to and including 2.14.9 contains a Server-Side Request Forgery (SSRF) vulnerability in the /wp-json/iawp/search public tracking route. The route accepts attacker-controlled referrer_url values when the signature matches. Signature validation is insufficient because the signing salt is static per site and the signature is embedded in publicly accessible JavaScript, allowing attackers to extract valid signatures. The stored referrer domains are later fetched by a scheduled favicon downloader in IAWP/Favicon/FaviconDownloader.php that uses raw cURL functions (curl_init, CURLOPT_URL) without any SSRF protection — it does not block localhost, private IP ranges, or use WordPress's wp_safe_remote_* functions [1][2][3][4].

Exploitation

An unauthenticated attacker first extracts a valid signature from the publicly available JavaScript file, then sends a crafted POST request to /wp-json/iawp/search with a malicious referrer_url (e.g., http://169.254.169.254/latest/meta-data/ or an internal service). The signature match writes the attacker-controlled domain into the database. When the favicon cron job triggers (or is forced), the plugin calls FaviconDownloader::download() which calls attempt_download() and uses curl_init with the attacker's URL, following redirects up to 10 times [3][4]. No network restrictions are enforced.

Impact

Successful exploitation allows an unauthenticated attacker to make arbitrary HTTP requests from the WordPress server to any host, including internal services (e.g., cloud metadata endpoints, internal APIs, databases). This can lead to information disclosure of sensitive data, such as cloud provider credentials or internal network reconnaissance [1][2]. The favicon fetcher runs with the web server's privileges and may be used to probe internal infrastructure.

Mitigation

A fix was released in version 2.14.10, which replaces the raw cURL fetch with WordPress's wp_safe_remote_get() and adds input validation on referrer_url [4]. Users must update to version 2.14.10 or later immediately. As a workaround, site administrators can disable the favicon downloader by removing the cron job or adding a web application firewall (WAF) rule to block requests to /wp-json/iawp/search with suspicious referrer_url values.