CVE-2026-1313

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-1313", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2026-01-21T20:56:50.859Z", "datePublished": "2026-03-21T03:26:52.055Z", "dateUpdated": "2026-04-08T17:02:26.430Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:26.430Z"}, "affected": [{"vendor": "eagerterrier", "product": "MimeTypes Link Icons", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.2.20", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the \"Show file size\" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content."}], "title": "MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1612"}, {"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1666"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "baseScore": 8.3, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "timeline": [{"time": "2026-03-20T15:17:37.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-23T15:17:52.360351Z", "id": "CVE-2026-1313", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:54:32.878Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-1313", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:17:52.360351Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-23T15:17:53.633Z"}}], "cna": {"title": "MimeTypes Link Icons <= 3.2.20 - Authenticated (Contributor+) Server-Side Request Forgery via Crafted Links in Post Content", "credits": [{"lang": "en", "type": "finder", "value": "Kai Aizen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.3, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L"}}], "affected": [{"vendor": "eagerterrier", "product": "MimeTypes Link Icons", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.20"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-03-20T15:17:37.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1612"}, {"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1666"}], "descriptions": [{"lang": "en", "value": "The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the \"Show file size\" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:26.430Z"}}}, "cveMetadata": {"cveId": "CVE-2026-1313", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:26.430Z", "dateReserved": "2026-01-21T20:56:50.859Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-03-21T03:26:52.055Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "MimeTypes Link Icons", "vendor": "eagerterrier", "versions": [{"lessThanOrEqual": "3.2.20", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the \"Show file size\" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content."}, {"lang": "es", "value": "El plugin MimeTypes Link Icons para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 3.2.20, inclusive. Esto se debe a que el plugin realiza peticiones HTTP salientes a URLs controladas por el usuario sin la validaci\u00f3n adecuada cuando la opci\u00f3n 'Mostrar tama\u00f1o de archivo' est\u00e1 habilitada. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede usarse para consultar y modificar informaci\u00f3n de servicios internos a trav\u00e9s de enlaces manipulados en el contenido de las publicaciones."}], "id": "CVE-2026-1313", "lastModified": "2026-06-17T10:15:34.843", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1313", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-03-23T15:17:52.360351Z", "version": "2.0.3"}}]}, "published": "2026-03-21T04:16:52.630", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1612"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1666"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,3.2.20]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "MimeTypes Link Icons", "source": "cna", "vendor": "eagerterrier"}, "product": "mimetypes_link_icons", "vendor": "eagerterrier"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-03-21T07:17:21.059467+00:00", "value": {"mitigation_remediation": ["Disable the \"Show file size\" option if you do not need to display file sizes.", "Update the MimeTypes Link Icons plugin to the latest available release, removing the vulnerability.", "If an update is not yet available, consider removing the plugin or limiting Contributor roles to trusted users only.", "Monitor server logs for unexpected outbound HTTP requests to detect potential exploitation attempts."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery enabling internal resource access"}, "threat_synthesis": {"affected_systems": "WordPress sites running the eagerterrier MimeTypes Link Icons plugin, in any version up to and including 3.2.20, are affected. The vulnerability applies regardless of the WordPress core version and requires only that a user with Contributor permissions or greater composes malicious post content.", "description_and_impact": "The MimeTypes Link Icons plugin for WordPress processes user\u2011controlled URLs when the \"Show file size\" setting is enabled, issuing outbound HTTP requests without proper validation. This flaw creates a Server\u2011Side Request Forgery vulnerability that allows authenticated users with Contributor level or higher to request arbitrary internal or external resources from the application\u2019s host. The ability to craft links embedded in post content means an attacker could retrieve sensitive data or alter internal services, though direct code execution is not possible.", "risk_and_exploitability": "The CVSS score of 8.3 indicates high severity; there is no EPSS score available and the issue is not listed in CISA\u2019s KEV catalog. Exploitation requires authenticated access and the \"Show file size\" option to be enabled. An attacker can inject a crafted link that causes the server to request internal endpoints, potentially exfiltrating data or modifying services. The risk is therefore primarily dependent on the attacker\u2019s privileged role and the sensitivity of the backend services accessed through SSRF."}}}}, "created": "2026-03-23T09:50:20.654910+00:00", "updated": "2026-03-25T14:42:01.047062+00:00", "vendors": ["eagerterrier", "eagerterrier$PRODUCT$mimetypes_link_icons", "wordpress", "wordpress$PRODUCT$wordpress"]}