The affected Webmention plugin allows unauthenticated attackers to trigger server‑side requests to arbitrary URLs through the MF2::parse_authorpage routine that runs during the Receiver::post handling. This form of SSRF can expose internal network resources, read sensitive data, or modify internal services, thereby compromising confidentiality and integrity of the host and any linked systems. The underlying weakness is identified as CWE‑918, a classic SSRF flaw where an attacker provides a crafted URL that the server fetches.

The vulnerability is present in all Webmention plugin releases up to and including version 5.6.2, which is used within WordPress sites. Site administrators running these versions should verify plugin versioning and promptly apply an update that removes the vulnerable parse_authorpage call.

The CVSS score of 7.2 indicates high severity. Although an EPSS score is not available, the absence of a known exploit in KEV suggests that exploitation may not yet be widespread, yet the unauthenticated nature and potential to access internal services make it a priority. Attackers would likely perform a POST request to the Webmention endpoint with a malicious URL; if the target system follows that URL, internal data may be disclosed or altered. Given the public availability of the code paths, successful exploitation is considered feasible in the intended environment.