Emplibot CVE-2025-11970

Requires an authenticated session at Administrator level or above (PR:H) on a WordPress site with the Emplibot plugin version ≤1.0.9 installed and active; the attacker must reach the emplibot_call_webhook_with_error() or emplibot_process_zip_data() code paths. Exploitation value further depends on the web server having network reachability to internal services or cloud metadata endpoints worth targeting. Limiting factors: the Administrator prerequisite is the dominant constraint (such a user already has extensive control of the site), and CVSS AC:H signals additional conditions beyond simply sending a request, which narrows realistic opportunistic exploitation.

This is a genuinely low-priority vulnerability despite being network-reachable. The provided CVSS 3.1 vector (AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N, base 4.4 MEDIUM) is dominated by two strong limiting factors: PR:H confirms the attacker must already hold Administrator-level access, and AC:H indicates non-trivial exploitation conditions. The scope change (S:C) and dual C:L/I:L reflect the SSRF's ability to reach and modify internal services, which is the only elevating signal. All exploitation-probability signals agree this is not an urgent threat: EPSS is 0.19% (8th percentile), it is NOT listed in CISA KEV, and no public exploit code is referenced - so there is no public exploit identified at time of analysis. The core mitigating reality is the PR:H requirement: an attacker who is already a WordPress Administrator can typically already install plugins, edit PHP, and run code, so the marginal privilege gained from this SSRF is modest and primarily matters for pivoting to internal network resources that the web host can reach but the admin otherwise could not. No signals conflict. This is a defense-in-depth / hardening fix, not a high-real-risk issue.

An attacker who has already obtained (or been granted) WordPress Administrator credentials on a site running Emplibot ≤1.0.9 crafts input that reaches the emplibot_call_webhook_with_error() or emplibot_process_zip_data() functions, causing the server to issue HTTP requests to an attacker-chosen URL. They point this at cloud metadata endpoints (e.g., 169.254.169.254) or internal-only services to read or modify data the web server can reach but external users cannot. No public proof-of-concept is referenced, and exploitation requires the high-privilege admin role.