CVE-2026-40500 MEDIUM

CVE-2026-40500: ProcessWire CMS SSRF via Add Module From URL

Vendor Processwire
Product processwire
Weakness CWE-918 · SSRF
Published April 15, 2026
Last update April 16, 2026
View on NVD All CVEs

CVSS base score

6.1/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N

What the vulnerability does

01Description

ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authenticated administrators to supply arbitrary URLs to the module download parameter, causing the server to issue outbound HTTP requests to attacker-controlled internal or external hosts. Attackers can exploit differentiable error messages returned by the server to perform reliable internal network port scanning, host enumeration across RFC-1918 ranges, and potential access to cloud instance metadata endpoints.

Key dates

02Disclosure timeline

April 15, 2026 CVE published
April 16, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-43884 WWBN AVideo: SSRF Protection Bypass via HTTP Redirect and DNS Rebinding in isSSRFSafeURL() CVE-2026-47157 aiograpi: Unsafe signup challenge path handling CVE-2024-33590 WordPress basepress plugin <= 2.16.1 - Server Side Request Forgery (SSRF) vulnerability CVE-2025-12376 Icon List Block – Add Icon-Based Lists with Custom Styles <= 1.2.1 - Authenticated (Subscriber+) Server-Side Request Forgery CVE-2022-31188 Server-Side Request Forgery Vulnerability in Computer Vision Annotation Tool (CVAT)