ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-5737

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9.

Published May 28, 2026 · catalog updated Oct 13, 2026 · Independent Analytics – WordPress Analytics Plugin

Patch now

CVE-2026-5737 is in the CISA known-exploited catalog. Confirm Independent Analytics – WordPress Analytics Plugin against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Severity
Medium6.5
Known exploitation
CISA KEV and VulnCheck KEV
EPSS
0.44%
Remediation
Remediation guidance
Affected products
stated Independent Analytics – WordPress Analytics Plugin · vendor bensibley Independent Analytics – WordPress Analytics Plugin

The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature validation is insufficient because the signature is embedded in publicly-accessible JavaScript and the salt is static per site, allowing attackers to extract valid signatures. The favicon downloader uses raw cURL functions without any SSRF protection mechanisms (no localhost blocking, no private network filtering, and does not use WordPress's wp_safe_remote_* functions). This makes it possible for unauthenticated attackers to inject malicious referrer domains into the database and trigger server-side requests to arbitrary hosts including internal services.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • stated Independent Analytics – WordPress Analytics Plugin<= 2.14.9
  • vendor bensibley Independent Analytics – WordPress Analytics Pluginversion unspecified

How to fix CVE-2026-5737

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2026-5737 is in the CISA known-exploited catalog. Confirm Independent Analytics – WordPress Analytics Plugin against the vendor advisory and apply that fix. The CVSS score does not change the priority.

Which versions are affected?

Compare what you have installed with Independent Analytics – WordPress Analytics Plugin <= 2.14.9. Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

What should an analyst verify?

CWE-918: Server-Side Request Forgery (SSRF). EPSS 0.44%. The CISA KEV listing is the exploitation evidence. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Technology hubs

WordPress security

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. May 28, 2026 · NIST NVD

    Detected

    The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature va

  2. Jun 17, 2026 · NIST NVD

    Updated

    The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature va

  3. Oct 13, 2026 · CISA KEV

    Known exploited

    Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.

  4. Oct 13, 2026 · VulnCheck KEV

    Updated

    The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches, combined with a scheduled favicon fetcher that performs unrestricted cURL requests to stored domains. The signature va

Sources

  • CVE.orgVulnerability recordCVE-2026-5737

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-5737

    30-day exploitation probability 0.4%

    first.org
  • NIST NVDVulnerability recordCVE-2026-5737

    The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches

    nvd.nist.gov
  • VulnCheck KEVConfirmed exploitationCVE-2026-5737

    The Independent Analytics plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.14.9. This is due to a public tracking route at /wp-json/iawp/search that accepts attacker-controlled referrer_url values when the signature matches

    vulncheck.com

References

Freshness

Last verified in this catalog Oct 18, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.