CVE-2026-4912
Deferred Deferred - Pending Action

Server-Side Request Forgery in Media Cleaner WordPress Plugin

Publication date: 2026-07-28

Last updated on: 2026-07-28

Assigner: Wordfence

Description
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-28
Last Modified
2026-07-28
Generated
2026-07-29
AI Q&A
2026-07-28
EPSS Evaluated
N/A
NVD
CVE-2026-4912
EUVD
EUVD-2026-49990

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
wp-media media_cleaner to 7.0.3 (inc)
wp_media_cleaner media_cleaner to 7.0.3 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The Media Cleaner plugin for WordPress has a Server-Side Request Forgery (SSRF) vulnerability in versions up to 7.0.3. The flaw exists in the get_urls_from_html() function, which uses DOMDocument::loadHTMLFile() to fetch iframe source URLs. The vulnerability occurs because the function performs insufficient hostname validation, relying only on a substring match against the site's server name. This allows authenticated attackers with Administrator-level access to make web requests to arbitrary internal or external locations from the web application.

Detection Guidance

This vulnerability requires checking for the Media Cleaner plugin version up to 7.0.3. Inspect your WordPress installation for the plugin and verify its version. No specific network or system commands are provided in the context to detect this SSRF vulnerability directly.

Impact Analysis

An attacker could exploit this vulnerability to interact with internal services or external systems not intended for public access. This could lead to unauthorized data access, internal network scanning, or further attacks against other systems within the same network. The impact is limited to authenticated users with Administrator privileges or higher.

Compliance Impact

This vulnerability could potentially violate compliance requirements under GDPR or HIPAA by allowing unauthorized access to internal systems or sensitive data. GDPR requires protecting personal data, while HIPAA mandates safeguarding protected health information. Exploitation of this flaw may lead to unauthorized data exposure, resulting in non-compliance with these regulations.

Mitigation Strategies

Immediately update the Media Cleaner plugin to the latest version beyond 7.0.3. If an update is not available, consider disabling or removing the plugin until a patch is released. Restrict Administrator-level access to only necessary users to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-4912. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart