Webmention CVE-2026-0686

Requires Webmention plugin for WordPress versions up to 5.6.2 to be installed and activated. No authentication needed. Remote unauthenticated attacker exploits 'MF2::parse_authorpage' function via 'Receiver::post' to forge requests to arbitrary internal services. Default WordPress installations with this plugin enabled are vulnerable.

This vulnerability presents HIGH real-world risk despite moderate CVSS 7.2 severity. Critical risk factors: (1) CVSS vector shows unauthenticated network exploitation (PR:N) with low complexity (AC:L) and no user interaction required (UI:N), maximizing attacker accessibility; (2) Changed scope (S:C) indicates potential lateral movement to internal systems; (3) Publicly available exploit code exists through documented vulnerable code paths in WordPress plugin repository and GitHub references, lowering exploitation barriers; (4) SSRF vulnerabilities are frequently exploited to access cloud metadata services (AWS IMDSv1, Azure IMDS), internal APIs, and administrative interfaces in containerized/cloud environments. Mitigating factors: (1) No CISA KEV listing indicates no confirmed active exploitation campaigns at time of analysis; (2) Impact ratings show only Low confidentiality and integrity impact (C:L/I:L) with no availability impact (A:N), suggesting exploitation requires chaining with other vulnerabilities for critical compromise; (3) Requires WordPress sites to have the Webmention plugin installed and actively processing webmentions. SSVC decision: Exploitation status is publicly available (POC), technical impact is partial (data exfiltration/modification possible), automatable (yes - no user interaction). This qualifies as an Act priority for organizations running affected WordPress installations with internal network segmentation concerns.

An unauthenticated attacker identifies a WordPress site running Webmention plugin ≤5.6.2 by detecting the /xmlrpc.php?rsd endpoint or observing webmention link tags in page headers. The attacker crafts a malicious webmention POST request to the target site's webmention endpoint, embedding a URL pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/iam/security-credentials/ for AWS metadata or http://192.168.1.100:8080/admin/config for an internal admin panel). When the vulnerable MF2::parse_authorpage function processes this request through Receiver::post, the WordPress server makes an HTTP request to the attacker-specified internal URL, returning the response content. The attacker exfiltrates cloud authentication credentials, internal API tokens, or sensitive configuration data, then uses these to pivot deeper into the infrastructure or modify internal application state. Publicly available exploit code exists demonstrating the vulnerable code paths, making exploitation accessible to moderately skilled attackers.