CVE-2026-0686

Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery

7.2 High

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.6.2 in the 'MF2::parse_authorpage' function via the 'Receiver::post' function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: None

Exploit likelihood

0.31%Up 0.3 points since Apr 2, 2026

What each source reports

CVE List Score used 7.2

Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery

Record: CVE-2026-0686
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

EUVDEUVD-2026-18132 7.2

Record: EUVD-2026-18132
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-pwm7-wr54-2jxv 7.2

The Webmention plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions...

Record: GHSA-pwm7-wr54-2jxv
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

NVD 7.2

Record: CVE-2026-0686
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

OSV 7.2

Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery

Record: CVE-2026-0686
CVSS 3.1: 7.2 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Weakness: CWE-918
Updated: 2026-11-02

Affected products

pfefferle webmention

History

History
Recorded	Changed	Sources
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-0686 is a high vulnerability (CVSS 7.2) in Pfefferle Webmention, published April 2, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.31%, the 24th percentile. No source names a fixed version.