CVE-2026-40500Disclosure

LOW

Signal is active with 2 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority. The "Add Module from URL" feature requires superuser privileges (root-equivalent in ProcessWire) who already has unrestricted arbitrary code execution via standard module upload, making the SSRF vector incapable of providing incremental attack surface. The feature is also disabled by default and requires direct filesystem access to enable.

Back to dashboard

0.0/ 10 priority

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

2 mentions across 1 observed day

What's happening

Technical details provided in 2 signals
Disclosure: 2 classified signals
2 total mentions across 1 day

Deep dive

Activity timeline2 mentions / 1d

Signal classification1 categories

Disclosure

2100.0%

Referenced assets3 URLs

By indicator

Full discourse2 posts

Vulmon Vulnerability Feed@VulmonFeeds176d
Disclosure
CVE-2026-40500 Server-Side Request Forgery in ProcessWire CMS 3.0.255 Admin Module Down... https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-40500 Vulnerability Notification: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=3
Post summary
The message announces a newly disclosed SS‑RF vulnerability (CVE‑2026‑40500) affecting ProcessWire CMS 3.0.255, but provides no exploit, patch, or active exploitation details.
0000041
4.0K followersView on X
CVE@CVEnew176d
Disclosure
CVE-2026-40500 ProcessWire CMS version 3.0.255 and prior contain a server-side request forgery vulnerability in the admin panel's 'Add Module From URL' feature that allows authentic… https://www.cve.org/CVERecord?id=CVE-2026-40500
Post summary
The text announces a SSRF vulnerability (CVE-2026-40500) in ProcessWire CMS’s admin panel feature, providing technical details but no evidence of exploitation or mitigation.
0000089
57.2K followersView on X

Explore more

Back to dashboard