Media Cleaner content scanning permits administrator-triggered SSRF through iframe sources
Media Cleaner uses the authenticated POST /wp-json/media-cleaner/v1/extract_references route to scan content when source is content; access is restricted by can_access_features() to Administrators by default. During that scan, get_urls_from_html() reads attacker-controlled iframe src attributes and versions through 7.0.5 accept an absolute URL whenever the site's server name appears anywhere in the URL. DOMDocument::loadHTMLFile() then requests that URL from the WordPress server, allowing an Administrator to reach arbitrary or internal services with a crafted hostname. The CNA identifies versions through 7.0.3 as affected, but official WordPress.org source retains the unsafe substring check in 7.0.4 and 7.0.5. Version 7.0.6 is the first published tag with strict parsed-host comparison, and its changelog explicitly identifies an SSRF fix for embedded iframes.
- Component
- Media Cleaner: Clean your WordPress!
- Plugin slug
media-cleaner- Affected
- <= 7.0.3
- Safe version
7.0.6- Published
- Jul 28, 2026
This CVE was published Jul 28, 2026 and is one of 2 known issues for this plugin.
Update, patch or deactivate.
Update Media Cleaner to 7.0.6 or later. Review web-server and outbound-request logs for unexpected requests made while Media Cleaner content scans were running.
A safe version is available, so updating to that version or later is the preferred remediation. If an immediate update is not practical, consider a targeted application patch or temporarily restricting the affected functionality.
Deactivate only when warranted by your risk profile, or when advised by your hosting provider in the limited circumstances where the vulnerability cannot otherwise be mitigated. If you’re unsure which action is appropriate, contact Fused or your hosting provider for guidance.
Technical description
The Media Cleaner: Clean your WordPress! plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 7.0.3. This is due to the `get_urls_from_html()` function using `DOMDocument::loadHTMLFile()` to fetch iframe source URLs with an insufficient hostname validation check that relies on a substring match against the site's server name. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and interact with internal services.
CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N