CVE-2026-1313 is a Server-Side Request Forgery vulnerability in the eagerterrier MimeTypes Link Icons WordPress plugin versions up to 3.2.20. The flaw arises because the plugin performs outbound HTTP requests to URLs controlled by users without sufficient validation when the "Show file size" feature is enabled. This allows authenticated attackers with Contributor or higher privileges to induce the server to send requests to arbitrary internal or external locations, potentially accessing or modifying internal services. The CVSS v3.1 base score is 8.3, indicating high severity with network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

An attacker with Contributor-level or higher access can leverage this SSRF vulnerability to make the server send arbitrary HTTP requests. This can lead to unauthorized information disclosure, modification of internal services, or disruption of availability within the internal network or other reachable systems. The vulnerability affects confidentiality, integrity, and availability of the affected environment. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling the "Show file size" option in the MimeTypes Link Icons plugin to prevent triggering the vulnerable code path. Limit Contributor-level access to trusted users only and monitor for suspicious activity related to this plugin.