CVE-2026-66654

WordPress Vehica Core plugin <= 1.0.104 - Server Side Request Forgery (SSRF) vulnerability

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

We have discovered 296 live websites that are affected by CVE-2026-66654.

Run a Free Instant Scan



Affected Software

Product  Vehica Core
Category Wordpress Plugins
Vulnerable Domains296 live websites (43% of Vehica Core install base)
Vulnerable Versions
  • from 0 through 1.0.104
Vulnerable Versions Count40 versions ( 89% of all versions)


Common Weakness Enumeration

CWE-918 Server-Side Request Forgery (SSRF)



Details

  • Published - Aug 13, 2026
  • Updated - Aug 13, 2026

Credits

  • Steven Julian | Patchstack Bug Bounty Program (finder)

Website Distribution by Country

Number of websites using CVE-2026-66654
United States53 websites


Italy28 websites
Spain21 websites
Germany20 websites
France20 websites
GB16 websites
Portugal13 websites
Brazil9 websites
Belgium8 websites
Cyprus8 websites

Website Distribution by TLD

Number of websites using CVE-2026-66654
.com105 websites
.it24 websites
.fr13 websites
.co.uk12 websites
.es11 websites
.at9 websites
.com.br9 websites
.de9 websites
.pl7 websites
.fi7 websites

Vulnerable Versions

Vulnerable versions are highlighted in red

Websites affected by CVE-2026-66654

Top websites that are affected by CVE-2026-66654. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
********.com GB*,***
******.fi Finland*,***,***
***.de Germany*,***,***
*****************.com Japan*,***,***
*****************.com United States*,***,***
*************.fi Finland*,***,***
***********.ru Russia*,***,***
***************.com United States*,***,***
************.com Portugal*,***,***
*************.fr Germany*,***,***
See full domain list

FAQ

CVE-2026-66654 is Server-Side Request Forgery (SSRF) in Vehica Core
A total of 296 websites have been identified as vulnerable to CVE-2026-66654, based on global website indexing conducted by WebTechSurvey.
The Vehica Core is affected by the CVE-2026-66654 vulnerability.
Vehica Core versions up to and including 1.0.104 are vulnerable to CVE-2026-66654.