EUVD-2026-38656
GHSA-mpqw-xp9q-3fpc
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network-reachable SSRF via 'url' parameter; scope changes to internal services with limited read/write impact and no availability effect.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2DescriptionCVE.org
The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Articles & Coverage 1
AnalysisAI
Server-Side Request Forgery in the WordPress URL Preview plugin (all versions through 1.0) allows unauthenticated attackers to coerce the WordPress server into making arbitrary outbound HTTP requests via the 'url' parameter. The flaw, reported by Wordfence and tracked as CWE-918, enables querying or modifying data on internal services reachable from the WordPress host, including cloud metadata endpoints and internal admin panels. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions - remote unauthenticated exploitation against default configurations of any WordPress site running the URL Preview plugin version 1.0 or earlier with the plugin activated. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) reflects a network-reachable, unauthenticated, low-complexity flaw with scope change and limited confidentiality/integrity impact - consistent with classic SSRF where the WordPress host itself is not compromised but adjacent internal systems can be read or modified. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker sends a crafted HTTP request to the WordPress site's URL Preview endpoint with the 'url' parameter pointing at http://169.254.169.254/latest/meta-data/iam/security-credentials/ on a cloud-hosted WordPress install, causing the server to fetch and return cloud instance credentials. The same primitive can be used to probe internal-only services such as Redis, Elasticsearch, or admin panels bound to localhost, modifying state where those services accept HTTP verbs without authentication. … |
| Remediation | No vendor-released patch identified at time of analysis - the advisory indicates the SSRF is present in all versions up to and including 1.0, with no fixed version cited. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Scan all WordPress installations for the URL Preview plugin; if present, immediately disable and uninstall it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today