PT-2026-29686 · WordPress · Webmention

Pfefferle · Published 2026-04-02 · Updated 2026-04-02 · CVE-2026-0686

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Webmention plugin for WordPress versions up to and including 5.6.2

Description The Webmention plugin for WordPress is susceptible to Server-Side Request Forgery in versions up to and including 5.6.2. This issue resides within the MF2::parse authorpage function, accessible through the Receiver::post function. An unauthenticated attacker can leverage this to make web requests to arbitrary locations originating from the web application, potentially querying and modifying information from internal services.

Recommendations Update the Webmention plugin to a version later than 5.6.2.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-0686

Affected Products

Webmention

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-0686 · Security Note
• https://github.com/pfefferle/wordpress-webmention/blob/057223cee18a9e93b017d0f21db6ea77a7686489/includes/handler/class-mf2.php#L878 · Note
• https://plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/handler/class-mf2.php#L877 · Note
• https://plugins.trac.wordpress.org/changeset/3494831/webmention · Note
• https://twitter.com/CVEnew/status/2039647705597915355 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/08d15c46-d15f-4803-80be-90bf33335c18?source=cve · Note
• https://plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/class-receiver.php#L260 · Note