The Webmention plugin for WordPress contains an SSRF vulnerability (CWE-918) in the 'MF2::parse_authorpage' function accessed through 'Receiver::post'. This allows unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, potentially enabling access to internal network resources or modification of internal data. The vulnerability affects all versions up to 5.6.2. It has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. There is no vendor advisory or patch information provided at this time.

An unauthenticated attacker can exploit this SSRF vulnerability to make the vulnerable server send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure and modification of internal services. The vulnerability does not impact availability. The scope is changed, meaning the vulnerability affects resources beyond the initially vulnerable component.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, such as firewall rules or egress filtering. Monitor for unusual outbound traffic patterns originating from the server hosting the Webmention plugin.