Media Cleaner: Clean your WordPress!
Media Cleaner: Clean your WordPress! is a WordPress component with 2 published CVE records in this archive. The latest tracked vulnerability was published Jul 28, 2026; the highest CVE/CNA score is 5.3.
media-cleanerCVE-2026-4912: Media Cleaner content scanning permits administrator-triggered SSRF through iframe sources
Media Cleaner uses the authenticated POST /wp-json/media-cleaner/v1/extract_references route to scan content when source is content; access is restricted by can_access_features() to Administrators by default. During that scan, get_urls_from_html() reads attacker-controlled iframe src attributes and versions through 7.0.5 accept an absolute URL whenever the site's server name appears anywhere in the URL. DOMDocument::loadHTMLFile() then requests that URL from the WordPress server, allowing an Administrator to reach arbitrary or internal services with a crafted hostname. The CNA identifies versions through 7.0.3 as affected, but official WordPress.org source retains the unsafe substring check in 7.0.4 and 7.0.5. Version 7.0.6 is the first published tag with strict parsed-host comparison, and its changelog explicitly identifies an SSRF fix for embedded iframes.
| Safe version |
|
||
|---|---|---|---|
| Jul 28, 2026 |
CVE-2026-4912
Media Cleaner content scanning permits administrator-triggered SSRF through iframe sources
Media Cleaner uses the authenticated POST /wp-json/media-cleaner/v1/extract_references route to scan content when source is content; access is restricted by can_access_features() to Administrators by default. During that scan, get_urls_from_html() reads attacker-controlled iframe src attributes and versions through 7.0.5 accept an absolute URL whenever the site's server name appears anywhere in the URL. DOMDocument::loadHTMLFile() then requests that URL from the WordPress server, allowing an Administrator to reach arbitrary or internal services with a crafted hostname. The CNA identifies versions through 7.0.3 as affected, but official WordPress.org source retains the unsafe substring check in 7.0.4 and 7.0.5. Version 7.0.6 is the first published tag with strict parsed-host comparison, and its changelog explicitly identifies an SSRF fix for embedded iframes.
|
7.0.6 |
CVE4.1
NVDPending
|
| May 02, 2024 |
CVE-2024-33922
WP Media Cleaner: A security weakness
WP Media Cleaner is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE5.3
NVDPending
|