Webmention <= 5.10.2 - Unauthenticated Server-Side Request Forgery via Webmention Source URL
- ID
- WPSEC-2026-1472
- Plugin
- Webmention (webmention)
- Affected
- all versions before 5.11.0
- Remediation
- Update to 5.11.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
- Weakness
- CWE-918
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Webmention on WPSec AttackSurface
- Fix released
- Published
Description
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery via the webmention endpoint's source URL in all versions up to, and including, 5.10.2. The cause is that when WP_DEBUG is enabled, the plugin hooks 'http_request_args' to set 'reject_unsafe_urls' to false for every outbound HTTP request, which overrides the protection wp_safe_remote_get() gives against private and reserved addresses. Its MF2 URL check also falls back to a format-only test instead of wp_http_validate_url(). This makes it possible for unauthenticated attackers to submit webmentions whose source URLs point at localhost or internal network addresses, so that the site sends requests to internal services and may query or change information on them. Exploitation requires WP_DEBUG to be enabled on the site.
References
- https://wpsec.com/vuln/WPSEC-2026-1472/
- https://plugins.svn.wordpress.org/webmention/tags/5.11.0/
- https://wordpress.org/plugins/webmention/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS