CVE-2026-4912: Media Cleaner WordPress Plugin SSRF Flaw

CVE-2026-4912 Overview

CVE-2026-4912 is a Server-Side Request Forgery (SSRF) vulnerability in the Media Cleaner: Clean your WordPress! plugin for WordPress. The flaw affects all versions up to and including 7.0.3. The get_urls_from_html() function uses DOMDocument::loadHTMLFile() to fetch iframe source URLs while relying on a substring match against the site's server name for hostname validation. This weak check allows authenticated attackers with Administrator-level access or above to issue web requests from the web application to arbitrary destinations. Attackers can leverage the flaw to query and interact with internal services otherwise unreachable from the public internet.

Critical Impact
Authenticated administrators can pivot through the WordPress server to reach internal-only services, cloud metadata endpoints, and other restricted network resources [CWE-918].

Affected Products

Media Cleaner: Clean your WordPress! plugin for WordPress — all versions up to and including 7.0.3
WordPress installations with Media Cleaner plugin enabled
Multi-site WordPress environments running the affected plugin

Discovery Timeline

2026-07-28 - CVE-2026-4912 published to the National Vulnerability Database (NVD)
2026-07-28 - Last updated in NVD database

Technical Details for CVE-2026-4912

Vulnerability Analysis

The vulnerability resides in the Media Cleaner plugin's URL extraction logic. The get_urls_from_html() function invokes PHP's DOMDocument::loadHTMLFile() to load remote HTML content and parse iframe source URLs. Before issuing the request, the plugin attempts to validate that the target URL belongs to the site's own server name. That check uses a substring match rather than strict hostname parsing and comparison.

An attacker who controls the input can craft URLs whose hostname contains the site's server name as a substring while pointing at an entirely different destination. Because loadHTMLFile() performs an outbound HTTP fetch through the server, the plugin becomes a request proxy on behalf of the attacker.

Root Cause

The root cause is insufficient hostname validation classified under [CWE-918] Server-Side Request Forgery. Substring matching against a server name does not enforce host equality, scheme restriction, or IP-address safety. Attackers can construct hostnames such as attacker.com/victim-site.example or victim-site.example.attacker.com to pass the check while resolving to attacker-controlled or internal-only infrastructure.

Attack Vector

Exploitation requires an authenticated session with Administrator-level privileges. The attacker submits a URL through the plugin's REST endpoint responsible for media analysis. The plugin then invokes loadHTMLFile() against the attacker-supplied URL. The outbound request originates from the WordPress host, allowing the attacker to reach internal HTTP services, cloud provider metadata endpoints such as 169.254.169.254, or private-network administrative interfaces. Refer to the Wordfence Vulnerability Report and the WordPress Media Cleaner Core Code for the vulnerable code path.

// Vulnerable pattern (described in prose - no verified PoC available)
// The plugin performs a substring check similar to:
//   if (strpos($url, $server_name) !== false) { loadHTMLFile($url); }
// An attacker-controlled URL containing $server_name as a substring bypasses the check.

Detection Methods for CVE-2026-4912

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal RFC1918 addresses or cloud metadata IPs such as 169.254.169.254
Unexpected entries in WordPress access logs referencing the Media Cleaner REST endpoint under /wp-json/media-cleaner/
PHP error logs showing DOMDocument::loadHTMLFile() calls with unusual remote hostnames
Administrator account activity from unfamiliar IP addresses preceding SSRF-related traffic

Detection Strategies

Monitor egress traffic from WordPress hosts and alert on connections to internal network ranges or metadata services
Inspect web server access logs for repeated POST or GET requests to Media Cleaner REST routes originating from a single administrator session
Correlate WordPress audit logs of administrator actions with outbound firewall events during the same time window
Deploy web application firewall rules that inspect URL parameters submitted to the plugin's endpoints for internal IPs and localhost variants

Monitoring Recommendations

Enable verbose logging of all wp-json REST API calls tied to the Media Cleaner plugin
Forward WordPress, PHP-FPM, and web server logs to a centralized log platform for correlation
Baseline normal outbound destinations from WordPress servers and alert on deviations
Track privileged WordPress account creation and login events to identify precursor compromise

How to Mitigate CVE-2026-4912

Immediate Actions Required

Update the Media Cleaner plugin to a patched version above 7.0.3 as published in the WordPress Media Cleaner Changeset
Audit all WordPress administrator accounts and rotate credentials for any account showing suspicious activity
Restrict outbound network access from WordPress hosts to only required destinations
Review recent plugin activity logs for signs of prior SSRF exploitation attempts

Patch Information

The plugin maintainer released a fix tracked in the WordPress plugin repository. Administrators should upgrade beyond version 7.0.3 immediately. Review the WordPress Media Cleaner REST Code and the corresponding changeset for the specific code changes addressing the hostname validation flaw.

Workarounds

Disable the Media Cleaner plugin until the patched version can be deployed
Enforce network segmentation so WordPress servers cannot reach cloud metadata endpoints or internal administrative interfaces
Apply egress firewall rules blocking WordPress hosts from initiating connections to RFC1918 ranges and 169.254.169.254
Restrict administrator role assignments and require multi-factor authentication for all privileged WordPress accounts

bash

# Example egress restriction using iptables to block metadata endpoint access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP