HIGHVulnerability
Verified
Global

NVD HIGH: CVE-2026-12100 — The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forger...

·Source: NIST NVD

Updated:

Executive Summary

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Analysis

The URL Preview plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0 via the 'url' parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. CVSS Score: 7.2. Published: 2026-06-24T07:16:26.647.

Indicators of Compromise (1)

CVE (1)
CVE-2026-12100
NVDMITRE CVE
Source Attribution

Originally published by NIST NVD on Jun 24, 2026. Verified by: NIST.

Related Threats

LOWVulnerabilityNEW

Azure Password-Spraying Attack Bypasses MFA Defenses

<img src="https://ismg-cdn.nyc3.cdn.digitaloceanspaces.com/articles/azure-password-spraying-attack-bypasses-some-mfa-defenses-image_small-4-a-32128.jpg" align=right hspace=4><b>Threat Actor Uses Deprecated OAuth 2.0 Authentication Flow</b><br>Attackers behind a password-spraying campaign targeting Microsoft Office 365 accounts have amassed dozens of victims by abusing a deprecated feature in OAuth

Bank Info Security
LOWVulnerabilityNEW

CVE-2026-13769 – Insecure file permissions in AWS CLI

<p><b>Bulletin ID:</b> 2026-049-AWS<br> <b>Scope:</b> AWS<br> <b>Content Type:</b> Important (requires attention)<br> <b>Publication Date:</b> 07/01/2026 11:45 AM PDT</p> <p><b>Description:</b></p> <p>The AWS Command Line Interface (AWS CLI) is a unified tool for managing AWS services from the command line. We identified CVE-2026-13769 in AWS CLI on Unix-like systems where the umask has not been c

CVE-2026-13769
AWS Security Bulletins
MEDIUMVulnerability

Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings

Microsoft's new Teams admin policy requires organizer approval for external AI bots, giving organizations greater visibility and control over automated participants in sensitive meetings. The post Microsoft Adds New Teams Controls to Block Unauthorized AI Bots From Meetings appeared first on SecurityWeek .

SecurityWeek