Executive brief
The Media Cleaner plugin for WordPress, which helps site owners remove unused media files, contains a security flaw that could allow an administrator to perform unauthorized network requests. By exploiting this vulnerability, an attacker with high-level access could probe internal network services or access data that is not intended to be public. While this requires administrative privileges, it could be used to pivot from a compromised site to other sensitive internal systems.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in the Media Cleaner plugin for WordPress due to improper validation in the `get_urls_from_html()` function. The function utilizes `DOMDocument::loadHTMLFile()` to process iframe source URLs, but the hostname validation relies on a weak substring match against the server's name. An authenticated attacker with Administrator-level privileges can bypass this check to force the web server to initiate outbound HTTP requests to arbitrary destinations. This can be leveraged to interact with internal metadata services, scan internal ports, or access other internal network resources. The vulnerability is present in all versions up to and including 7.0.3.
Affected products
- tigroumeow Media Cleaner: Clean your WordPress! up to, and including, 7.0.3
Timeline
- 2026-07-28: disclosed
- 2026-07-28: advisory
References
- https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php
- https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/core.php
- https://plugins.trac.wordpress.org/browser/media-cleaner/tags/7.0.3/classes/rest.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&n%20ew3492257%40media-cleaner%2Ftrunk&old=3447443%40media-cleaner%2Ftrunk&sfp_ema%20il=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c9214d-45d4-4477-8244-7802a4901114?source=cve