The Media Cleaner plugin contains a Server‑Side Request Forgery flaw that allows any authenticated user with Administrator privileges to make HTTP requests to arbitrary URLs from the web server. The vulnerability stems from an inadequate hostname check in the get_urls_from_html() routine, which accepts destinations that include the host name as a substring. As a result, an attacker can direct the server to reach internal or exposed services and potentially exfiltrate data or trigger unauthorized actions.

Affected systems are WordPress installations that include the Media Cleaner plugin version 7.0.3 or earlier. All versions up to 7.0.3 are vulnerable; no official patch or version update is provided in the CVE data. Sites relying on this plugin for media management, including those hosted on any platform running WordPress, must be examined for the plugin version.

The CVSS score of 4.1 indicates a medium severity, while the EPSS score of less than 1 % signals a low likelihood of exploitation. The vulnerability is not listed in CISA’s KEV catalogue, suggesting no publicly documented attacks yet. Exploitation requires administrator access; the scope is limited to internal network resources reachable from the server. Observed attack paths could involve probing internal APIs, DNS servers, or localhost services that the server can reach.