CVE-2026-1313: WordPress MimeTypes Link Icons SSRF Flaw

CVE-2026-1313 Overview

CVE-2026-1313 is a Server-Side Request Forgery (SSRF) vulnerability affecting the MimeTypes Link Icons plugin for WordPress in all versions up to and including 3.2.20. The vulnerability exists because the plugin makes outbound HTTP requests to user-controlled URLs without proper validation when the "Show file size" option is enabled. This allows authenticated attackers with Contributor-level access or above to make web requests to arbitrary locations originating from the web application, potentially enabling them to query and modify information from internal services via crafted links in post content.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to access internal services, potentially exposing sensitive data and enabling further attacks against infrastructure not normally accessible from the public internet.

Affected Products

• MimeTypes Link Icons WordPress Plugin version 3.2.20 and earlier
• WordPress installations with the MimeTypes Link Icons plugin and "Show file size" option enabled
• Any WordPress site where Contributor-level or higher user access may be compromised

Discovery Timeline

• 2026-03-21 - CVE-2026-1313 published to NVD
• 2026-03-23 - Last updated in NVD database

Technical Details for CVE-2026-1313

Vulnerability Analysis

This SSRF vulnerability stems from insufficient input validation in the MimeTypes Link Icons plugin's file size retrieval functionality. When the "Show file size" feature is enabled, the plugin performs HTTP requests to URLs specified in post content to determine the size of linked files. The vulnerability occurs because these URLs are not properly validated before the request is made, allowing attackers to specify arbitrary internal or external URLs.

The vulnerable code can be found in the mime_type_link_images.php file at lines 1612 and 1666 of version 3.2.20. The attack requires authentication at the Contributor level or above, which represents a lower privilege boundary but still limits exploitation to authenticated users.

Root Cause

The root cause of CVE-2026-1313 is the lack of proper URL validation and sanitization before making outbound HTTP requests. The plugin fails to implement controls such as:

• URL scheme validation (allowing file://, gopher://, or other dangerous protocols)
• Host validation to prevent requests to internal IP addresses and localhost
• DNS rebinding protections
• Allowlist-based URL filtering

This falls under CWE-918 (Server-Side Request Forgery), where the application accepts a user-controlled URL and makes an HTTP request to that URL without adequate validation.

Attack Vector

The attack vector is network-based and requires an authenticated attacker with at least Contributor-level privileges on the WordPress installation. The attack flow involves:

1. An attacker with Contributor access creates or edits a post containing a malicious link
2. The link URL points to an internal service (e.g., http://169.254.169.254/ for cloud metadata or http://localhost:8080/admin)
3. When the post is processed with the "Show file size" option enabled, the server makes an HTTP request to the attacker-specified URL
4. The attacker can observe responses or leverage the requests to interact with internal services

The vulnerability can be exploited to access cloud provider metadata services, scan internal networks, interact with internal APIs, or bypass firewall restrictions that protect internal services from external access.

Detection Methods for CVE-2026-1313

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• HTTP requests to cloud metadata endpoints such as 169.254.169.254 or Azure/GCP equivalent services
• Post content containing links to internal hostnames, localhost, or RFC 1918 IP addresses
• Unexpected network connections from the web server to services it normally wouldn't communicate with

Detection Strategies

• Monitor web server logs for outbound requests to internal IP addresses or metadata service endpoints
• Implement network-level monitoring for connections from web servers to internal infrastructure
• Review WordPress post content for suspicious URLs pointing to internal resources
• Use Web Application Firewalls (WAF) with SSRF detection rules to identify and block malicious requests
• Enable DNS query logging to detect resolution attempts for internal hostnames from the WordPress server

Monitoring Recommendations

• Configure alerting for any HTTP requests from the WordPress server to internal network ranges
• Set up egress filtering rules to detect unauthorized outbound connections
• Monitor authentication logs for unusual Contributor-level account activity
• Implement content security policies and review mechanisms for post submissions

How to Mitigate CVE-2026-1313

Immediate Actions Required

• Update the MimeTypes Link Icons plugin to a patched version (if available) or disable the plugin immediately
• Disable the "Show file size" option in the plugin settings as a temporary mitigation
• Review and audit existing post content for potentially malicious URLs
• Restrict Contributor-level access to trusted users only
• Implement network segmentation to limit the impact of potential SSRF attacks

Patch Information

Review the Wordfence vulnerability analysis for the latest patch status and remediation guidance. Check the WordPress plugin repository for updated versions of MimeTypes Link Icons that address this vulnerability. The vulnerable code is located in mime_type_link_images.php at line 1612 and line 1666.

Workarounds

• Disable the MimeTypes Link Icons plugin entirely until a patch is available
• If the plugin is required, disable the "Show file size" feature in plugin settings
• Implement egress filtering at the network level to prevent the WordPress server from connecting to internal services
• Use a Web Application Firewall with SSRF protection rules to block malicious requests
• Restrict user roles and audit Contributor-level accounts to minimize the attack surface

# Configuration example - Disable plugin via WP-CLI
wp plugin deactivate mimetypes-link-icons

# Alternatively, restrict outbound connections at the network level
# Add iptables rules to block outbound connections to internal ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP