What is the CVSS score of CVE-2025-68893?

CVE-2025-68893 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-68893

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-12-29 audit@patchstack.com

WordPress SSRF

4.9

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:43 NVD

4.9 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects WordPress Image shrinker: from n/a through <= 1.1.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in WordPress Image Shrinker plugin versions up to 1.1.0 enables unauthenticated remote attackers to forge requests from the affected server to internal or external resources, potentially exposing sensitive data or enabling lateral movement within network infrastructure. The vulnerability has extremely low exploitation probability (EPSS 0.04th percentile) and no public exploit code identified, suggesting limited real-world threat despite the technical severity of SSRF vulnerabilities.

Technical ContextAI

This SSRF vulnerability (CWE-918) affects the HETWORKS WordPress Image Shrinker plugin, which provides image optimization functionality for WordPress installations. SSRF flaws occur when an application fails to properly validate user-supplied input when constructing server-side HTTP requests, allowing attackers to manipulate the plugin into making requests to unintended destinations. In this context, the vulnerability likely resides in the image processing or download mechanism where the plugin fetches or processes images from URLs without adequate validation, potentially exposing internal services running on localhost, private cloud metadata endpoints, or other network-accessible systems.

Affected ProductsAI

WordPress Image Shrinker plugin by HETWORKS, versions through 1.1.0, is affected. The plugin is distributed via the WordPress plugin repository and installed on WordPress sites requiring image optimization functionality. Specific CPE data not provided in source materials, but affected installations can be identified through WordPress admin panels showing plugin version 1.1.0 or earlier.

RemediationAI

Update the WordPress Image Shrinker plugin to a version newer than 1.1.0 immediately through the WordPress admin dashboard (Plugins > Updates) or via direct download from the official WordPress plugin repository. Vendors typically release patched versions following vulnerability disclosure; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-image-shrinker/vulnerability/wordpress-wordpress-image-shrinker-plugin-1-1-0-server-side-request-forgery-ssrf-vulnerability for exact patched version availability and release timeline. If an immediate patch is unavailable, disable the plugin until an update is released to eliminate the attack surface entirely.