CVE-2026-1313

The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the "Show file size" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content.

CVSS v3 8.3 HIGH

8.3^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope CHANGED

References

Link	Resource
https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1612
https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1666
https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve

Configurations

No configuration.

History

22 Apr 2026, 21:32

Type	Values Removed	Values Added
Summary		(es) El plugin MimeTypes Link Icons para WordPress es vulnerable a falsificación de petición del lado del servidor en todas las versiones hasta la 3.2.20, inclusive. Esto se debe a que el plugin realiza peticiones HTTP salientes a URLs controladas por el usuario sin la validación adecuada cuando la opción 'Mostrar tamaño de archivo' está habilitada. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicación web y puede usarse para consultar y modificar información de servicios internos a través de enlaces manipulados en el contenido de las publicaciones.

21 Mar 2026, 04:16

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-03-21 04:16

Updated : 2026-06-17 10:15

NVD link : CVE-2026-1313

Mitre link : CVE-2026-1313

CVE.ORG link : CVE-2026-1313

JSON object : View

Products Affected

No product.

CWE

CWE-918

Server-Side Request Forgery (SSRF)

{"id": "CVE-2026-1313", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-1313", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-23T15:17:52.360351Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@wordfence.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 3.7, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security@wordfence.com", "affectedData": [{"vendor": "eagerterrier", "product": "MimeTypes Link Icons", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.2.20"}], "defaultStatus": "unaffected"}]}], "published": "2026-03-21T04:16:52.630", "references": [{"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1612", "source": "security@wordfence.com"}, {"url": "https://plugins.trac.wordpress.org/browser/mimetypes-link-icons/tags/3.2.20/mime_type_link_images.php#L1666", "source": "security@wordfence.com"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7b035d17-303b-4a8b-a15e-615df6b605d1?source=cve", "source": "security@wordfence.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@wordfence.com", "description": [{"lang": "en", "value": "CWE-918"}]}], "descriptions": [{"lang": "en", "value": "The MimeTypes Link Icons plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.2.20. This is due to the plugin making outbound HTTP requests to user-controlled URLs without proper validation when the \"Show file size\" option is enabled. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services via crafted links in post content."}, {"lang": "es", "value": "El plugin MimeTypes Link Icons para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 3.2.20, inclusive. Esto se debe a que el plugin realiza peticiones HTTP salientes a URLs controladas por el usuario sin la validaci\u00f3n adecuada cuando la opci\u00f3n 'Mostrar tama\u00f1o de archivo' est\u00e1 habilitada. Esto permite a atacantes autenticados, con acceso de nivel Colaborador o superior, realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede usarse para consultar y modificar informaci\u00f3n de servicios internos a trav\u00e9s de enlaces manipulados en el contenido de las publicaciones."}], "lastModified": "2026-06-17T10:15:34.843", "sourceIdentifier": "security@wordfence.com"}