What is the CVSS score of CVE-2025-48294?

CVE-2025-48294 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-48294

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-07-16 audit@patchstack.com

WordPress SSRF

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

4.4 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in FG Drupal to WordPress plugin versions 3.90.0 and earlier allows remote attackers to make arbitrary HTTP requests from the affected WordPress server, potentially accessing internal services, cloud metadata endpoints, or other backend resources. The vulnerability has an extremely low EPSS score (0.03%, 10th percentile), indicating minimal observed exploitation probability despite public availability of vulnerability details.

Technical ContextAI

The vulnerability is a classic SSRF flaw (CWE-918) affecting the FG Drupal to WordPress plugin, a WordPress migration tool. SSRF vulnerabilities occur when an application accepts user-controlled input used to construct HTTP requests without proper validation or allowlisting, enabling attackers to force the server to connect to arbitrary destinations. In this context, the plugin likely accepts user input during the Drupal-to-WordPress migration process (such as source URLs or configuration parameters) without sanitizing them before making backend HTTP requests. The CWE-918 classification confirms insufficient input validation on outbound request targets. WordPress plugin context means this affects WordPress sites running the affected plugin versions up to 3.90.0.

Affected ProductsAI

FG Drupal to WordPress plugin for WordPress, versions 3.90.0 and earlier. The plugin is distributed via the WordPress plugin repository and documented in the Patchstack vulnerability database (CPE information not provided in available data). Affected installations include all WordPress sites running this plugin with version numbers up to and including 3.90.0.

RemediationAI

Update the FG Drupal to WordPress plugin to a version later than 3.90.0 immediately. WordPress administrators should navigate to Plugins > Installed Plugins, locate FG Drupal to WordPress, and select Update if available. Consult the official plugin page on wordpress.org/plugins/fg-drupal-to-wp/ or the vendor advisory at https://patchstack.com/database/Wordpress/Plugin/fg-drupal-to-wp/vulnerability/wordpress-fg-drupal-to-wordpress-plugin-3-90-0-server-side-request-forgery-ssrf-vulnerability for confirmation of patch availability and exact patched version numbers. If automatic updates are unavailable, manually download and install the latest plugin version from the WordPress plugin repository.