CVE-2026-1313: SSRF in MimeTypes Link Icons WordPress Plugin

The SSRF vulnerability enables an attacker to craft malicious links within WordPress post content, triggering outbound HTTP requests to attacker-controlled URLs. Because the plugin doesn't properly validate these URLs when the "Show file size" option is enabled, an attacker can leverage this to query and potentially modify data from internal services that are accessible to the WordPress server. This could expose sensitive information, allow for unauthorized access to internal resources, or even facilitate further attacks against the underlying infrastructure. The impact is amplified if the WordPress server has access to sensitive internal systems or APIs. While requiring Contributor access, this is a common privilege level, expanding the potential attack surface.

1. Reserved2026-01-21
2. Published2026-03-20
3. Modified2026-04-17
4. EPSS updated2026-03-28

The primary mitigation for CVE-2026-1313 is to immediately upgrade the MimeTypes Link Icons plugin to version 3.3.0 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider disabling the "Show file size" option within the plugin's settings, as this feature is the root cause of the vulnerability. As a temporary workaround, a web application firewall (WAF) or reverse proxy can be configured to block outbound requests to suspicious or unauthorized domains. Monitor WordPress access logs for unusual outbound HTTP requests originating from user-controlled content.

Active installs

8KKnown

Plugin rating