7.2
HighCVSS 3.1 · from Wordfence
CVE-2026-0686
Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery
Webmention · Server-side request forgery · CWE-918AffectedWebmention
FixNo fix listed yet.
PublishedApr 2, 07:39 · Wordfence
ScoredApr 2 · 7.2 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
From Wordfence
Affected and fixed versions
ProductAffectedFixed inWebmentionup to 5.6.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known