CVE-2026-4912

Name of the Vulnerable Software and Affected Versions Media Cleaner: Clean your WordPress! versions prior to 7.0.4

Description An issue exists where the get urls from html() function uses DOMDocument::loadHTMLFile() to fetch iframe source URLs. The process employs an insufficient hostname validation check based on a substring match against the site server name. This allows authenticated attackers with Administrator-level access or higher to perform Server-Side Request Forgery (SSRF), enabling them to initiate web requests to arbitrary locations from the application to query or interact with internal services.

Recommendations Update to version 7.0.4 or later. As a temporary mitigation, restrict access to the get urls from html() function.