What is the CVSS score of CVE-2026-0686?

CVE-2026-0686 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Webmention are affected by CVE-2026-0686?

The WordPress Webmention plugin (versions ≤5.6.2) contains a server-side request forgery vulnerability that allows unauthenticated attackers to force your web servers into making unauthorized…

How to fix or mitigate CVE-2026-0686?

Within 24 hours: Identify all WordPress instances running Webmention plugin ≤5.6.2 and disable or deactivate the plugin immediately. Within 7 days: Contact plugin vendor for patch status and timeline; implement network segmentation to restrict outbound HTTP/HTTPS requests from web servers to internal systems (via firewall rules or WAF). Within 30 days: Monitor vendor advisory for patched versions ≥5.6.3; upon availability, test patched version in staging environment and deploy to production.

Webmention CVE-2026-0686

EUVD-2026-18132 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-02 Wordfence

WordPress SSRF Webmention Wordpress Plugin Pfefferle

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 27, 2026 - 19:07 vuln.today

cvss_changed

EUVD ID Assigned

Apr 02, 2026 - 07:45 euvd

EUVD-2026-18132

Analysis Generated

Apr 02, 2026 - 07:45 vuln.today

CVE Published

Apr 02, 2026 - 07:39 nvd

HIGH 7.2

DescriptionCVE.org

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery (SSRF) in WordPress Webmention plugin versions ≤5.6.2 allows unauthenticated remote attackers to force the web server to make arbitrary HTTP requests to internal or external systems. The vulnerability exists in the MF2::parse_authorpage function called through Receiver::post, enabling attackers to probe internal network services, exfiltrate data from cloud metadata endpoints, or modify internal resources. EPSS data not provided; no CISA KEV status indicating confirmed active exploitation at time of analysis. Public exploit code exists (proof-of-concept references available via Wordfence and WordPress plugin repository).

Technical ContextAI

The Webmention plugin implements the Webmention protocol (W3C specification for cross-site comment/notification mechanisms). The vulnerability (CWE-918: Server-Side Request Forgery) occurs in the MF2::parse_authorpage function within includes/handler/class-mf2.php at line 878, invoked via the Receiver::post function (includes/class-receiver.php line 260). These functions process incoming webmention requests to parse author page metadata using the MF2 (Microformats2) parser. Insufficient input validation allows attacker-controlled URLs to be passed directly to server-side HTTP request functions without proper allowlisting, protocol restriction, or network boundary enforcement. The affected CPE (cpe:2.3:a:pfefferle:webmention) identifies Matthias Pfefferle's Webmention plugin for WordPress. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is a network-exploitable vulnerability requiring no authentication, low attack complexity, and no user interaction, with Changed scope indicating impact beyond the vulnerable component.

RemediationAI

Upgrade immediately to Webmention plugin version 5.6.3 or later, which addresses the SSRF vulnerability through input validation improvements implemented in WordPress plugin changeset 3494831 (https://plugins.trac.wordpress.org/changeset/3494831/webmention). Site administrators should access WordPress admin dashboard, navigate to Plugins > Installed Plugins, locate Webmention, and click Update Now. Alternatively, manually download version 5.6.3+ from the official WordPress plugin repository and replace the existing installation. If immediate patching is not feasible, implement network-level controls: (1) configure web application firewall (WAF) rules to inspect and block webmention POST requests containing suspicious URL patterns (private IP ranges, cloud metadata endpoints like 169.254.169.254, localhost references); (2) restrict outbound HTTP/HTTPS connections from the WordPress server using egress filtering to block access to RFC1918 private networks (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and link-local addresses; (3) consider temporarily disabling the Webmention plugin if the functionality is not business-critical. Review server logs for suspicious webmention activity targeting internal resources prior to patching.