What is the CVSS score of CVE-2026-1313?

CVE-2026-1313 has a CVSS 3.1 base score of 8.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-1313?

A high-severity vulnerability in the MimeTypes Link Icons WordPress plugin allows authenticated users to make unauthorized requests from our servers to internal systems, potentially exposing…

How to fix or mitigate CVE-2026-1313?

Within 24 hours: Disable the 'Show file size' option in the MimeTypes Link Icons plugin settings across all WordPress installations, or deactivate the plugin entirely if not critical to operations. Within 7 days: Conduct an audit of all WordPress instances to identify which sites use this plugin and document current versions. Within 30 days: Implement a Web Application Firewall (WAF) rule to block suspicious HTTP requests originating from WordPress processes, and establish a process to immediately apply the vendor patch once released.

WordPress CVE-2026-1313

EUVD-2026-14184 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-03-21 Wordfence

GHSA-mfxp-r5ch-25v4

WordPress SSRF

8.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 21, 2026 - 04:00 euvd

EUVD-2026-14184

Analysis Generated

Mar 21, 2026 - 04:00 vuln.today

CVE Published

Mar 21, 2026 - 03:26 nvd

HIGH 8.3

DescriptionCVE.org

The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the "Show file size" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content.

AnalysisAI

The MimeTypes Link Icons plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability affecting all versions up to and including 3.2.20. Authenticated attackers with Contributor-level access or higher can exploit this flaw when the 'Show file size' option is enabled by embedding crafted links in post content, allowing them to make arbitrary HTTP requests from the server to internal or external resources. This enables querying and potentially modifying information from internal services that should not be accessible from the public internet.

Technical ContextAI

The vulnerability exists in the MimeTypes Link Icons plugin (CPE: cpe:2.3:a:eagerterrier:mimetypes_link_icons:*:*:*:*:*:*:*:*), specifically within the file size retrieval functionality located in mime_type_link_images.php around lines 1612 and 1666. This is a classic CWE-918 Server-Side Request Forgery vulnerability where the plugin performs outbound HTTP requests to URLs provided by users without adequate validation or sanitization. When processing links with the 'Show file size' feature enabled, the plugin directly fetches content from user-supplied URLs, allowing attackers to abuse the server's network position to access internal resources, cloud metadata endpoints (like AWS EC2 metadata at 169.254.169.254), or perform port scanning of internal infrastructure.

RemediationAI

Users should immediately update the MimeTypes Link Icons plugin to a version newer than 3.2.20 once a patched version becomes available, monitoring the WordPress plugin repository and vendor advisories at https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve for updates. As an interim mitigation, administrators should disable the 'Show file size' option in the plugin settings to prevent the vulnerable code path from executing. Additionally, implement network-level controls such as Web Application Firewall (WAF) rules to detect and block SSRF attempts, restrict outbound connections from the WordPress server to only necessary external services, and review user roles to ensure only trusted users have Contributor-level access or above. Organizations should audit existing post content for suspicious links that may have been inserted by attackers prior to mitigation.