6.4
MediumCVSS 3.1 · from Wordfence
CVE-2026-0688
Webmention <= 5.6.2 - Authenticated (Subscriber+) Server-Side Request Forgery
Webmention · Server-side request forgery · CWE-918AffectedWebmention
FixNo fix listed yet.
PublishedApr 2, 07:39 · Wordfence
ScoredApr 2 · 6.4 · Wordfence
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:06 UTC
What we know
No known exploitation. CISA KEV, checked 22:06 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 via the 'Tools::read' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
From Wordfence
Affected and fixed versions
ProductAffectedFixed inWebmentionup to 5.6.2–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known