Is CVE-2026-4912 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-4912 being exploited in the wild.

How severe is CVE-2026-4912?

Medium severity, with a CVSS score of 4.1, published 28 July 2026.

Which products and versions are affected?

Meow Apps Media Cleaner up to, and including, 7.0.3.

Is there a fix for CVE-2026-4912?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-4912 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-4912?

Check whether you run Meow Apps Media Cleaner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-4912: Tigroumeow Media Cleaner SSRF in get_urls_from_html

CVE-2026-4912 · Severity: medium · CVSS 4.1 · Published 2026-07-28

The Media Cleaner plugin for WordPress, which helps site owners remove unused media files, contains a security flaw that could allow an administrator to perform unauthorized network requests. By exploiting this vulnerability, an attacker with high-level access could probe internal network services or access data that is not intended to be public. While this requires administrative privileges, it could be used to pivot from a compromised site to other sensitive internal systems.

Vendors: Meow Apps.

Quick answers

Is CVE-2026-4912 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-4912 being exploited in the wild.
How severe is CVE-2026-4912?: Medium severity, with a CVSS score of 4.1, published 28 July 2026.
Which products and versions are affected?: Meow Apps Media Cleaner up to, and including, 7.0.3.
Is there a fix for CVE-2026-4912?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-4912 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-4912?: Check whether you run Meow Apps Media Cleaner at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the Media Cleaner plugin for WordPress due to improper validation in the `get_urls_from_html()` function. The function utilizes `DOMDocument::loadHTMLFile()` to process iframe source URLs, but the hostname validation relies on a weak substring match against the server's name. An authenticated attacker with Administrator-level privileges can bypass this check to force the web server to initiate outbound HTTP requests to arbitrary destinations. This can be leveraged to interact with internal metadata services, scan internal ports, or access other internal network resources. The vulnerability is present in all versions up to and including 7.0.3.

Affected products

tigroumeow Media Cleaner: Clean your WordPress! up to, and including, 7.0.3

Timeline

2026-07-28: disclosed
2026-07-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.