CVE-2025-48294
Lifecycle Timeline
2Description
Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.
Analysis
Server-Side Request Forgery (SSRF) in FG Drupal to WordPress plugin versions 3.90.0 and earlier allows remote attackers to make arbitrary HTTP requests from the affected WordPress server, potentially accessing internal services, cloud metadata endpoints, or other backend resources. The vulnerability has an extremely low EPSS score (0.03%, 10th percentile), indicating minimal observed exploitation probability despite public availability of vulnerability details.
Technical Context
The vulnerability is a classic SSRF flaw (CWE-918) affecting the FG Drupal to WordPress plugin, a WordPress migration tool. SSRF vulnerabilities occur when an application accepts user-controlled input used to construct HTTP requests without proper validation or allowlisting, enabling attackers to force the server to connect to arbitrary destinations. In this context, the plugin likely accepts user input during the Drupal-to-WordPress migration process (such as source URLs or configuration parameters) without sanitizing them before making backend HTTP requests. The CWE-918 classification confirms insufficient input validation on outbound request targets. WordPress plugin context means this affects WordPress sites running the affected plugin versions up to 3.90.0.
Affected Products
FG Drupal to WordPress plugin for WordPress, versions 3.90.0 and earlier. The plugin is distributed via the WordPress plugin repository and documented in the Patchstack vulnerability database (CPE information not provided in available data). Affected installations include all WordPress sites running this plugin with version numbers up to and including 3.90.0.
Remediation
Update the FG Drupal to WordPress plugin to a version later than 3.90.0 immediately. WordPress administrators should navigate to Plugins > Installed Plugins, locate FG Drupal to WordPress, and select Update if available. Consult the official plugin page on wordpress.org/plugins/fg-drupal-to-wp/ or the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/fg-drupal-to-wp/vulnerability/wordpress-fg-drupal-to-wordpress-plugin-3-90-0-server-side-request-forgery-ssrf-vulnerability for confirmation of patch availability and exact patched version numbers. If automatic updates are unavailable, manually download and install the latest plugin version from the WordPress plugin repository.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today