Webmention CVE-2026-0688

The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-accessible attack with low complexity and low privilege barrier (Subscriber role is the lowest standard WordPress user tier), creating meaningful real-world risk despite the moderate 6.4 score. The Low impact on Confidentiality and Integrity (C:L/I:L) with no Availability impact limits damage scope, but the Changed Scope (S:C) signals potential lateral movement to internal systems. The privilege requirement of PR:L is critical-this is not an unauthenticated flaw but requires account creation, which many open WordPress installations allow by default. EPSS exploitation probability is moderate, suggesting this is a legitimate concern for security teams but not a critical emergency; however, sites allowing open user registration are at higher risk. The lack of KEV (CISA KEV) confirmation and unknown POC status at time of analysis suggest no active widespread exploitation campaigns, though the straightforward nature of SSRF attacks means proof-of-concept development would be straightforward for determined threat actors.

An attacker with a Subscriber-level WordPress account (obtainable through user registration on open sites or from compromised credentials) crafts a Webmention request containing a malicious URL pointing to an internal service, such as http://127.0.0.1:8080/admin or a private IP range service. The Tools::read function processes this request without validating the destination, causing the WordPress server to make an HTTP request to the internal target. The attacker receives the response, allowing them to enumerate internal services, extract data from metadata endpoints (e.g., AWS instance metadata), or interact with unprotected internal applications. No user interaction is required due to the UI:N vector.