Webmention Plugin Server-Side Request Forgery

Server-Side Request Forgery (SSRF) in WordPress Webmention plugin versions ≤5.6.2 allows unauthenticated remote attackers to force the web server to make arbitrary HTTP requests to internal or external systems. The vulnerability exists in the MF2::parse_authorpage function called through Receiver::post, enabling attackers to probe internal network services, exfiltrate data from cloud metadata endpoints, or modify internal resources. EPSS data not provided; no CISA KEV status indicating confirmed active exploitation at time of analysis. Public exploit code exists (proof-of-concept references available via Wordfence and WordPress plugin repository).

Server-Side Request Forgery in Webmention plugin for WordPress (versions up to 5.6.2) allows authenticated attackers with Subscriber-level access to make arbitrary web requests from the affected server via the Tools::read function, enabling reconnaissance and potential modification of internal services. EPSS score of 6.4 reflects moderate real-world exploitability risk given the low privilege requirement and network-accessible attack vector, though exploitation requires valid WordPress authentication.