CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
Webmention versions up to 5.6.2 contain a server-side request forgery vulnerability that allows an attacker to make the site send HTTP requests to arbitrary destinations. No authentication or user interaction is required. An attacker can read internal network resources or interact with services the site can reach. Update to version 5.8.1 or later.
What an attacker can do
Make the site send HTTP requests to internal networks or external services on the attacker's behalf.
Potential impact on your site
Attackers can access internal services, read metadata from cloud providers, or interact with backend systems your site can reach.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
