# Webmention <= 5.10.2 - Unauthenticated Server-Side Request Forgery via Webmention Source URL

- **ID:** WPSEC-2026-1472
- **Plugin:** Webmention (`webmention`), https://wordpress.org/plugins/webmention/
- **Affected versions:** all versions before 5.11.0
- **Fixed in:** 5.11.0 (Update to 5.11.0 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N)
- **Weakness:** CWE-918
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-10-22)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/webmention
- **Fix released:** 2026-10-21
- **Published:** 2026-10-22
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1472/

## Description

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery via the webmention endpoint's source URL in all versions up to, and including, 5.10.2. The cause is that when WP_DEBUG is enabled, the plugin hooks 'http_request_args' to set 'reject_unsafe_urls' to false for every outbound HTTP request, which overrides the protection wp_safe_remote_get() gives against private and reserved addresses. Its MF2 URL check also falls back to a format-only test instead of wp_http_validate_url(). This makes it possible for unauthenticated attackers to submit webmentions whose source URLs point at localhost or internal network addresses, so that the site sends requests to internal services and may query or change information on them. Exploitation requires WP_DEBUG to be enabled on the site.

## References

- https://wpsec.com/vuln/WPSEC-2026-1472/
- https://plugins.svn.wordpress.org/webmention/tags/5.11.0/
- https://wordpress.org/plugins/webmention/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1472/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.