CVE-2026-96654: Plex Media Server searchOne URL injection exposes plugin calls before 1.43.3.10861

Plex has patched a flaw in Plex Media Server that let an unauthenticated attacker inject a URL through the product's searchOne endpoint and use it to invoke plugin functions with parameters of their choosing. The issue, tracked as CVE-2026-96654, affects builds before 1.43.3.10861, and according to a dev.to analysis it shares its fix version with three other identifiers patched in the same release, sitting one step away from a server-side request forgery issue in the same set.

How the injection works

The dev.to write-up explains that searchOne is a search endpoint that accepts a URL pointing at a provider and forwards it to plugin code. Because the value is never checked against an allowlist of permitted schemes and hosts, a crafted URL arrives at the plugin dispatcher with parameters the caller fully controls. The wording of the official record matters here: the ability to call other plugins' functions means the attacker is not confined to the plugin the request nominally targets. The only conditions for exploitation are a reachable HTTP interface and a request that survives whatever parsing the endpoint performs.

Severity and impact

The CVE numbering authority classifies the bug as CWE-84, improper neutralization of encoded URI schemes in a web page. Its CVSS v3.1 base score is 6.5 with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N, and the CVSS v4.0 score is 6.9. Every privilege and interaction field points to an unauthenticated, remote entry point that requires no user interaction. CISA's SSVC entry, as cited by dev.to, records exploitation as none but marks the issue as automatable.

Confidentiality and integrity are both rated low, with no availability impact. The practical result, per the write-up, is an attacker able to trigger plugin functionality that was never meant to be reachable from the search path, which can disclose metadata the plugin had access to or modify state the plugin manages.

Affected versions and exposure

All Plex Media Server builds below 1.43.3.10861 are affected, and 1.43.3.10861 is the fixed version. The blast radius depends on which plugins are installed, because the flaw exposes plugin functions rather than a fixed internal service.

For context, dev.to reports that a ZoomEye query for Plex Media Server returned 507,974 matches at the time of writing, a measure of how widely the product is deployed rather than of vulnerable installs. Queries filtered on the CVE identifiers themselves returned no matches, so the product count should be treated as background only.

Patching and mitigation

The primary fix is updating to 1.43.3.10861 or later. Where an upgrade cannot happen immediately, the write-up recommends removing or disabling plugins that are not in use, since every plugin adds functions an injected call could reach, and placing a proxy rule in front of the server that rejects search requests carrying absolute URLs. After the upgrade, administrators should compare the installed plugin inventory against what the server actually needs.

Why it matters

The combination of properties in this CVE is what makes it worth attention: network-reachable, no privileges required, no user interaction, and rated automatable under CISA's SSVC process. Rather than granting direct access to a fixed internal service, the flaw turns the plugin surface itself into the attack surface, so the more plugins installed, the more functions an attacker can potentially invoke. Media servers frequently run on always-on home machines, and half a million internet-visible instances suggests a large pool of potentially unpatched targets. The remediation guidance also carries a broader lesson for plugin-based architectures: shrinking the plugin inventory is a useful defense-in-depth measure even on systems that are already patched.