CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery

🗓️ 02 Apr 2026 07:39:35Reported by WordfenceType

CVE-2026-0686: WordPress Webmention plugin up to 5.6.2 enables unauthenticated blind server-side requests via Receiver::post.

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2026-0686	2 Apr 202607:39	–	attackerkb
Circl	CVE-2026-0686	2 Apr 202609:15	–	circl
CNNVD	WordPress plugin Webmention 代码问题漏洞	2 Apr 202600:00	–	cnnvd
CVE	CVE-2026-0686	2 Apr 202607:39	–	cve
EUVD	EUVD-2026-18132	2 Apr 202609:30	–	euvd
NVD	CVE-2026-0686	2 Apr 202608:16	–	nvd
Patchstack	WordPress Webmention plugin <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery vulnerability	2 Apr 202600:57	–	patchstack
Positive Technologies	PT-2026-29686	2 Apr 202600:00	–	ptsecurity
RedhatCVE	CVE-2026-0686	3 Apr 202610:57	–	redhatcve
Vulnrichment	CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery	2 Apr 202607:39	–	vulnrichment

[
  {
    "vendor": "pfefferle",
    "product": "Webmention",
    "versions": [
      {
        "version": "0",
        "status": "affected",
        "lessThanOrEqual": "5.6.2",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "unaffected"
  }
]

Source	Link
plugins	www.plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/handler/class-mf2.php
plugins	www.plugins.trac.wordpress.org/browser/webmention/tags/5.6.2/includes/class-receiver.php
github	www.github.com/pfefferle/wordpress-webmention/blob/057223cee18a9e93b017d0f21db6ea77a7686489/includes/handler/class-mf2.php
wordfence	www.wordfence.com/threat-intel/vulnerabilities/id/08d15c46-d15f-4803-80be-90bf33335c18
plugins	www.plugins.trac.wordpress.org/changeset/3494831/webmention

08 Apr 2026 16:34Current

CVSS 3.17.2

EPSS0.00024

CWE-918