What is the CVSS score of CVE-2025-5818?

CVE-2025-5818 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-5818

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-07-23 security@wordfence.com

WordPress SSRF

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Jul 23, 2025 - 03:15 nvd

MEDIUM 5.5

DescriptionCVE.org

The Featured Image Plus - Quick & Bulk Edit with Unsplash plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.6.6 via the fip_get_image_options() function. This makes it possible for authenticated attackers, with administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery in Featured Image Plus - Quick & Bulk Edit with Unsplash WordPress plugin through version 1.6.6 allows authenticated administrators to make arbitrary web requests from the vulnerable server via the fip_get_image_options() function, potentially enabling reconnaissance and modification of internal services. No public exploit code or active CISA KEV confirmation documented; however, the vulnerability requires administrator-level access and presents a CVSS 5.5 score reflecting limited confidentiality and integrity impact.

Technical ContextAI

The vulnerability exists in the fip_get_image_options() function within the block editor actions component (block-editor-actions.php, line 166) of the Featured Image Plus WordPress plugin. The underlying weakness is CWE-918 (Server-Side Request Forgery), which occurs when a web application fetches remote resources without properly validating or restricting the target URL. In this case, the plugin fails to sanitize or restrict the destination of web requests initiated on behalf of the server, allowing an authenticated attacker with administrator credentials to redirect those requests to internal network resources, local services (localhost), or external arbitrary hosts. This is particularly dangerous in WordPress multisite environments or shared hosting scenarios where SSRF can be chained with other vulnerabilities to pivot through network trust boundaries.

Affected ProductsAI

Featured Image Plus - Quick & Bulk Edit with Unsplash WordPress plugin versions up to and including 1.6.6. The plugin is distributed via the official WordPress Plugin Directory at plugins.trac.wordpress.org/browser/featured-image-plus. All installations running version 1.6.6 or earlier are vulnerable if any administrator accounts exist on the site.

RemediationAI

Update the Featured Image Plus plugin to version 1.6.7 or later immediately. The vendor has released a patched version (referenced in the changeset snapshot) that sanitizes and restricts the fip_get_image_options() function to prevent arbitrary URL specification. Administrators should navigate to WordPress Dashboard > Plugins > Featured Image Plus and click Update, or enable automatic updates for plugins. If immediate update is not possible, restrict administrator role membership to only trusted users and consider temporarily disabling the plugin if it is not actively in use. Refer to the Wordfence threat intelligence page (https://www.wordfence.com/threat-intel/vulnerabilities/id/6904f168-e06f-4f17-905b-a943a39dfbdb) for additional context and confirmation of patch availability.