CVE-2026-19075

CVE-2026-19075 is an unauthenticated arbitrary URL resolution vulnerability in a WordPress plugin — specifically, an endpoint that accepts a video download request, reads a URL from post meta data, and streams that resource to the user without validating where it points. If you're running this plugin, that's the attack surface: an attacker can make your server fetch and deliver content from any URL they specify. What matters here isn't just patching — it's recognizing the pattern. This is the same vulnerability class that has appeared in at least seven other WordPress plugin CVEs across the 2019-2024 period. The pattern is: an unauthenticated endpoint reads a URL from stored data and resolves it server-side. Every time it appears, the root cause is the same — a developer thinking 'this is just a video URL field' without modeling what happens when that field contains a cloud metadata endpoint, an internal service, or another site's resource. The security implication requires a threat modeling frame that the feature development context doesn't naturally provide. Check your deployment immediately for this pattern in any plugin: unauthenticated endpoints that pull URLs from database fields and resolve them. If you find one, the remediation isn't complex — validate the URL against an allowlist of permitted domains before resolution, or require authentication on any endpoint performing external fetches. The fix is straightforward; the failure is in the gap between feature implementation and security review. Two compounding factors should elevate your priority. First, this capability doesn't exist in isolation — it sits at the intersection of other potential vulnerabilities. An attacker who can modify post meta through any other auth vector (author account, comment permissions, REST API exposure) gains the ability to weaponize this endpoint for internal reconnaissance, cloud metadata access, or pivoting to infrastructure compromise. The CVSS 5.0 base score doesn't capture this compounding effect. Second, if the plugin is unmaintained or abandoned, the exposure window has been accumulating since the vulnerable code shipped — and unmaintained code doesn't get harder to exploit over time, the surrounding attack landscape gets easier. Assume this vulnerability will be weaponized using the exact template established by prior CVEs in this family; the exploit methodology is pre-validated and requires no reverse engineering.

Reviewed through automated stages and approved by a human before publication.