CVE-2026-4912 in Media Cleaner Plugin
Summary
by MITRE • 07/28/2026
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The Media Cleaner plugin for WordPress presents a critical Server-Side Request Forgery vulnerability that affects all versions up to and including 7.0.3. This security flaw stems from inadequate hostname validation within the get_urls_from_html() function which employs DOMDocument::loadHTMLFile() to process iframe source URLs. The vulnerability occurs because the plugin performs only a substring match against the site's server name rather than implementing proper hostname validation, creating an avenue for malicious exploitation.
The technical implementation of this flaw involves the plugin's reliance on DOMDocument::loadHTMLFile() which accepts remote URLs and attempts to fetch content from them without sufficient validation. When processing HTML content containing iframe sources, the plugin checks if the URL hostname matches the current site's server name through a simple string comparison rather than comprehensive hostname verification. This naive approach allows attackers to craft malicious iframe URLs that appear to originate from legitimate domains while actually pointing to internal network resources or external malicious endpoints.
Authenticated attackers with Administrator-level privileges can exploit this vulnerability to make web requests from the WordPress application server to arbitrary locations, effectively enabling them to interact with internal services that would normally be protected by network segmentation. The attack vector leverages the plugin's legitimate functionality to fetch remote content while simultaneously creating a pathway for unauthorized access to internal systems, potentially exposing sensitive data or allowing further lateral movement within the network infrastructure.
This vulnerability directly maps to CWE-918 Server-Side Request Forgery and aligns with ATT&CK technique T1071.004 Application Layer Protocol: DNS, where attackers can manipulate application functions to access internal resources. The impact extends beyond simple data exfiltration as it provides attackers with the ability to probe internal services, potentially identifying other vulnerable systems or network configurations that could serve as additional attack vectors.
Organizations should immediately update to the latest version of the Media Cleaner plugin once available, while implementing network-level restrictions such as firewall rules that prevent outbound connections from web servers to internal network segments. Additional mitigations include configuring the WordPress application server with strict egress filtering and implementing monitoring for unusual outbound traffic patterns. Security teams should also consider implementing web application firewalls to detect and block suspicious requests originating from the vulnerable plugin functions, particularly those attempting to access internal IP ranges or non-standard ports that would not typically be accessed by legitimate web applications.