Wordpress Plugin
CVE-2025-67623
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
4DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in 6Storage 6Storage Rentals 6storage-rentals allows Server Side Request Forgery.This issue affects 6Storage Rentals: from n/a through <= 2.20.2.
AnalysisAI
Server-Side Request Forgery (SSRF) in 6Storage Rentals WordPress plugin versions ≤2.20.2 allows unauthenticated remote attackers to send crafted requests from the vulnerable server to arbitrary internal or external systems. With CVSS 9.1 (critical) due to network-accessible attack vector requiring no authentication or user interaction, attackers can achieve high confidentiality and integrity impact by potentially accessing internal services, cloud metadata endpoints, or exfiltrating sensitive data. EPSS score of 0.04% (14th percentile) indicates relatively low observed exploitation probability despite the critical severity rating. No confirmed active exploitation (not in CISA KEV) and no public exploit code identified at time of analysis.
Technical ContextAI
This vulnerability stems from CWE-918 (Server-Side Request Forgery), occurring when the 6Storage Rentals WordPress plugin fails to properly validate user-supplied URLs or destination addresses before making server-side HTTP requests. SSRF vulnerabilities allow attackers to abuse the server as a proxy to interact with internal network resources, cloud instance metadata services (such as AWS EC2 metadata at 169.254.169.254), or external systems that trust requests originating from the vulnerable server's IP address. In WordPress plugin contexts, SSRF commonly arises from unsafe handling of webhook URLs, remote file fetching, API integrations, or proxy functionality where user input influences the destination of outbound requests without adequate validation, sanitization, or allowlist controls.
Affected ProductsAI
The vulnerability affects 6Storage Rentals, a WordPress plugin developed by 6Storage for managing rental property operations, specifically all versions from an unspecified starting point through version 2.20.2 inclusive. The plugin is distributed through the WordPress plugin repository and is used by property management businesses to integrate rental management functionality into WordPress sites. Organizations running any version of the 6storage-rentals WordPress plugin at or below version 2.20.2 should consider themselves affected. The vulnerability was reported by the Patchstack security research team (audit@patchstack.com), which maintains a database of WordPress plugin vulnerabilities. Full technical details and vendor advisory are available at the Patchstack database reference link provided.
RemediationAI
Upgrade the 6Storage Rentals WordPress plugin to version 2.20.3 or later, which should contain fixes for the SSRF vulnerability based on the disclosed affected version range ending at 2.20.2. Site administrators should access the WordPress admin dashboard, navigate to Plugins, locate 6Storage Rentals, and apply available updates immediately. Prior to patching, organizations can implement temporary mitigations including restricting outbound network access from the WordPress server using firewall rules or security groups to block access to internal IP ranges (RFC 1918 addresses, link-local addresses including 169.254.0.0/16), implementing egress filtering to allow only necessary external destinations, enabling IMDSv2 on cloud instances which requires authenticated metadata requests, and reviewing web application firewall (WAF) rules to detect and block SSRF patterns in plugin requests. After patching, conduct security testing to verify the SSRF vector is remediated and review server logs for indicators of prior exploitation attempts such as unusual outbound connection patterns or requests to internal IP addresses. Detailed vulnerability information and remediation guidance is available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/6storage-rentals/vulnerability/wordpress-6storage-rentals-plugin-2-19-9-server-side-request-forgery-ssrf-vulnerability.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today