CVE-2026-65496
MediumCVSS 4.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Complianz plugin versions 7.5.0 and earlier have a Server-Side Request Forgery (SSRF) vulnerability exploitable by an author. A user with author role can force the server to send requests to internal resources.
Risk Assessment
The risk includes the possibility of scanning the internal network or accessing sensitive services, potentially leading to further attack escalation.
Recommendation
It is recommended to update the Complianz plugin to a version newer than 7.5.0 that fixes this vulnerability.
Other vulnerabilities in Complianz
See all- CVE-2026-97339High
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress (versions up to and including 7.5.5) is vulnerable to stored Cross-Site Scripting (XSS) via comment content and the yotu-wp Cookie-Blocker filter due to insufficient input sanitization and output escaping. An unauthenticated attacker can inject arbitrary web scripts into pages that execute when a user accesses the injected page.
- CVE-2026-65498Medium
The Complianz plugin versions 7.5.0 and earlier are vulnerable to unauthenticated sensitive data exposure. Unauthenticated attackers can access confidential information.
- CVE-2026-65497High
The Complianz plugin versions up to 7.5.0 contain a PHP Object Injection vulnerability exploitable by an administrator. An attacker with admin privileges can inject a malicious PHP object.
Original NVD description (English source)
Author Server Side Request Forgery (SSRF) in Complianz <= 7.5.0 versions.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS