CVE-2026-12100

Name of the Vulnerable Software and Affected Versions URL Preview plugin for WordPress versions prior to 1.1

Description The plugin is susceptible to Server-Side Request Forgery (SSRF), a flaw where an attacker can force the server to make requests to an unintended location. Unauthenticated attackers can leverage the url parameter to make web requests to arbitrary locations originating from the web application, which may be used to query and modify information from internal services.

Recommendations Update the plugin to a version later than 1.0. As a temporary workaround, restrict access to or avoid using the url parameter until the update is applied.