Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2026-12100

URL Preview <= 1.0 - Unauthenticated Server-Side Request Forgery via 'url' Parameter

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Wordfence

Description

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

abhisheksaha11 URL Preview

Default version status: unaffected

  • 0 to ≤ 1.0affected

References