The Webmention WordPress plugin contains a flaw in its read function that will send HTTP requests to any URL supplied by the caller. An attacker who can authenticate to the site with at least Subscriber privileges can trigger this function, allowing the plugin to reach internal network services, retrieve sensitive data, or modify state on those services. This type of vulnerability falls under the Server‑Side Request Forgery weakness and can potentially expose confidential information or compromise internal interfaces.

WordPress sites running the Webmention plugin from the developer pfefferle. Versions up to and including 5.6.2 are affected; all newer releases contain the fix.

The CVSS base score is 6.4, indicating a moderate severity. No EPSS data is currently available and the issue is not listed in the CISA KEV catalog. Attack requires the victim to be authenticated with Subscriber-level or higher access, after which the attacker can remotely influence outbound requests. While exploitation does not give direct code execution, it can bypass network segmentation and lead to data leakage or further internal attacks.