CVE-2026-40500

ProcessWire CMS has a server‑side request forgery in the admin panel feature Add Module From URL affecting version 3.0.255 and earlier. An authenticated administrator can supply arbitrary URLs to the module download parameter, triggering the server to issue outbound HTTP requests to attacker‑cont...