CVE-2026-0688 is a Server-Side Request Forgery vulnerability (CWE-918) in the pfefferle Webmention WordPress plugin. It exists in the 'Tools::read' function and affects all versions up to 5.6.2. The flaw allows authenticated attackers with at least Subscriber privileges to induce the server to send HTTP requests to arbitrary locations. This can be leveraged to access or manipulate internal services that are otherwise inaccessible externally. The CVSS 3.1 base score is 6.4, reflecting a medium impact on confidentiality and integrity, with no impact on availability.

An attacker with Subscriber-level or higher access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal service data, potentially exposing sensitive information or altering internal state. The vulnerability does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level access to trusted users only and monitor for suspicious activity related to the Webmention plugin. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow updates from the pfefferle project or WordPress plugin repository for any forthcoming patches.