CVE-2026-4912 is a Server-Side Request Forgery vulnerability in the Media Cleaner: Clean your WordPress! plugin for WordPress. The issue is due to the get_urls_from_html() function relying on DOMDocument::loadHTMLFile() to fetch iframe source URLs without proper hostname validation, using only a substring match against the server's hostname. This flaw allows authenticated users with Administrator privileges or higher to cause the server to make arbitrary HTTP requests to internal or external resources, potentially exposing internal services or data. The vulnerability affects all versions up to and including 7.0.3. No official patch or remediation level has been provided in the available data.

An authenticated attacker with Administrator-level access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external locations. This can lead to unauthorized querying or interaction with internal services that are not otherwise accessible externally. The impact is limited to information disclosure (confidentiality impact) without integrity or availability impact, as indicated by the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the plugin. Avoid exposing sensitive internal services that could be targeted via SSRF. Follow vendor updates closely for an official patch or mitigation.