CVE-2026-12100 is a Server-Side Request Forgery (SSRF) vulnerability in the URL Preview WordPress plugin by abhisheksaha11. It affects all versions up to and including 1.0 through the 'url' parameter, enabling unauthenticated attackers to induce the server to make arbitrary HTTP requests. This can be leveraged to access or manipulate internal services that are otherwise inaccessible externally. The vulnerability is publicly known and assigned a CVSS 3.1 base score of 7.2, indicating high severity. No vendor advisory or patch is currently available, and there are no known exploits in the wild.

An attacker can exploit this SSRF vulnerability to make the vulnerable server send arbitrary HTTP requests to internal or external systems. This can lead to unauthorized information disclosure and modification of internal services. The vulnerability does not directly allow remote code execution or denial of service but can be a stepping stone for further attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the URL Preview plugin if it is not essential. Additionally, restricting outbound HTTP requests from the web server at the network level may help mitigate exploitation risks.