Webmention WordPress Plugin Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the Webmention plugin for WordPress, affecting all versions through 5.6.2. The vulnerability exists in the 'MF2::parse_authorpage' function, which is called by the 'Receiver::post' function. This flaw allows unauthenticated attackers to send web requests to arbitrary locations from the web application, potentially querying and modifying information on internal services.

Impact

Exploitation of this vulnerability allows for unauthenticated blind server-side request forgery, where an attacker can make requests to internal services from the perspective of the web application.

Remediation

Users can update to version 5.7.0 or a newer patched version to address this vulnerability.