SSRF in Pfefferle Webmention
CVE-2026-0686
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthentica…
Vulnerability class: SSRF (Server-Side Request Forgery)
EPSS: 0.000 (7.2th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
Affected products
- Pfefferle Webmention — versions 0
Weakness classification (CWE)
References
- www.wordfence.com/threat-intel/vulnerabilities/id/08d15c46-d15f-4803-80be-90bf3…
- github.com/pfefferle/wordpress-webmention/blob/057223cee18a9e93b017d0f21db6ea77…
- plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/handler/class…
- plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/class-receive…
- plugins.trac.wordpress.org/changeset/3494831/webmention
Frequently asked questions
- What is CVE-2026-0686?
- CVE-2026-0686 is a high-severity vulnerability in Pfefferle Webmention, classified under Server-Side Request Forgery (SSRF). CVSS score: 7.2/10. Published 2026-04-02.
- How severe is CVE-2026-0686?
- High severity. CVSS v3 base score is 7.2 out of 10.