Executive brief
The URL Preview plugin for WordPress, which is used to generate previews of external links, contains a security flaw that allows unauthorized individuals to force the website to make requests to internal or external locations. This could allow an attacker to scan your internal network, access sensitive data from other internal services, or potentially modify information on systems that are not intended to be public. This poses a risk to the confidentiality and integrity of your internal infrastructure.
Technical details
The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of the 'url' parameter in the class.linkpreview.php component. An unauthenticated remote attacker can exploit this by providing a malicious URL, causing the web server to initiate requests to arbitrary destinations. This can be leveraged to bypass network firewalls and interact with internal services or metadata endpoints (such as AWS/GCP metadata services) that are otherwise inaccessible from the public internet. The vulnerability exists in all versions up to and including 1.0.
Affected products
- abhisheksaha11 URL Preview up to, and including, 1.0
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory