What is the CVSS score of CVE-2026-0688?

CVE-2026-0688 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Webmention CVE-2026-0688

EUVD-2026-18134 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-02 Wordfence

GHSA-wjf6-53j2-2f8c

WordPress SSRF Webmention Wordpress Plugin Pfefferle

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 02, 2026 - 07:45 euvd

EUVD-2026-18134

Analysis Generated

Apr 02, 2026 - 07:45 vuln.today

CVE Published

Apr 02, 2026 - 07:39 nvd

MEDIUM 6.4

DescriptionCVE.org

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery in Webmention plugin for WordPress (versions up to 5.6.2) allows authenticated attackers with Subscriber-level access to make arbitrary web requests from the affected server via the Tools::read function, enabling reconnaissance and potential modification of internal services. EPSS score of 6.4 reflects moderate real-world exploitability risk given the low privilege requirement and network-accessible attack vector, though exploitation requires valid WordPress authentication.

Technical ContextAI

The vulnerability exists in the Tools::read function within the Webmention plugin's class-tools.php file, a component responsible for processing web mentions (a web standard for notifying websites about links). The SSRF flaw (CWE-918) stems from insufficient validation of URLs passed to internal HTTP request functions, allowing attackers to construct requests to arbitrary internal or external endpoints. The plugin, identified by CPE cpe:2.3:a:pfefferle:webmention:*:*:*:*:*:*:*:*, is widely distributed through the official WordPress plugin repository and used by sites implementing the Webmention protocol for decentralized commenting and interactions.

RemediationAI

Update the Webmention plugin to version 5.6.3 or later, which patches the SSRF vulnerability in the Tools::read function (see changeset 3494831 at https://plugins.trac.wordpress.org/changeset/3494831/webmention). The patched version implements proper URL validation and request filtering to prevent access to internal or unintended endpoints. Additionally, site administrators should review WordPress user roles and permissions to restrict Subscriber-level access if not needed, and consider network-level controls (firewall rules, WAF) to limit outbound HTTP requests from the web application server. Monitoring for unusual outbound connections from the WordPress application can help detect exploitation attempts.