What is the CVSS score of CVE-2026-12100?

CVE-2026-12100 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of URL Preview Plugin are affected by CVE-2026-12100?

The WordPress URL Preview plugin (all versions through 1.0) contains a Server-Side Request Forgery vulnerability allowing unauthenticated attackers to coerce your WordPress servers into making…

How to fix or mitigate CVE-2026-12100?

Within 24 hours: Scan all WordPress installations for the URL Preview plugin; if present, immediately disable and uninstall it. Within 7 days: Review web server and firewall logs for outbound requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254); conduct forensic analysis to determine if the vulnerability was exploited. Within 30 days: Monitor for vendor-released patches and deploy immediately upon availability; document and validate all compensating controls.

URL Preview Plugin CVE-2026-12100

EUVD-2026-38656 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-24 Wordfence

GHSA-mpqw-xp9q-3fpc

SSRF WordPress Url Preview

7.2

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated network-reachable SSRF via 'url' parameter; scope changes to internal services with limited read/write impact and no availability effect.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 24, 2026 - 06:55 vuln.today

CVE Published

Jun 24, 2026 - 05:33 cve.org

HIGH 7.2

DescriptionCVE.org

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Articles & Coverage 1

News 18 New WordPress Vulnerabilities - 2 Critical, 6 With POC Jun 25, 2026

AnalysisAI

Server-Side Request Forgery in the WordPress URL Preview plugin (all versions through 1.0) allows unauthenticated attackers to coerce the WordPress server into making arbitrary outbound HTTP requests via the 'url' parameter. The flaw, reported by Wordfence and tracked as CWE-918, enables querying or modifying data on internal services reachable from the WordPress host, including cloud metadata endpoints and internal admin panels. No public exploit identified at time of analysis, but the vulnerability is trivially exploitable given AV:N/AC:L/PR:N/UI:N.

Technical ContextAI

The vulnerability sits in the abhisheksaha11 URL Preview (link-preview) plugin for WordPress, identified by CPE cpe:2.3:a:abhisheksaha11:url_preview:*:*:*:*:*:*:*:*. The referenced source lines in class.linkpreview.php (L30, L112) implement the link preview retrieval, fetching the user-supplied 'url' parameter server-side without sufficient validation or destination allowlisting. CWE-918 (Server-Side Request Forgery) describes exactly this class: the server is induced to make outbound network requests to attacker-chosen targets, which is dangerous in shared-hosting and cloud environments where internal-only services (cloud metadata at 169.254.169.254, internal admin APIs, databases bound to localhost) trust requests originating from the WordPress host.

RemediationAI

No vendor-released patch identified at time of analysis - the advisory indicates the SSRF is present in all versions up to and including 1.0, with no fixed version cited. Site operators should deactivate and uninstall the URL Preview plugin until a patched release is published, monitoring the WordPress.org plugin page and the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/05de038f-eff4-4b00-930c-3d2335345869 for an update. As compensating controls, place WordPress behind an egress firewall or proxy that denies outbound requests to RFC1918 ranges, 169.254.169.254 (cloud metadata), and localhost (side effect: any legitimate plugin needing internal API access will break); on AWS, enforce IMDSv2 to mitigate metadata token theft via SSRF (side effect: requires applications to use session-token requests). If the plugin must remain enabled, restrict access to its endpoint at the web-server or WAF layer to authenticated administrators only (side effect: breaks any front-end usage of the preview feature).