CVE-2025-68893
Lifecycle Timeline
2Description
Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects WordPress Image shrinker: from n/a through <= 1.1.0.
Analysis
Server-Side Request Forgery (SSRF) in WordPress Image Shrinker plugin versions up to 1.1.0 enables unauthenticated remote attackers to forge requests from the affected server to internal or external resources, potentially exposing sensitive data or enabling lateral movement within network infrastructure. The vulnerability has extremely low exploitation probability (EPSS 0.04th percentile) and no public exploit code identified, suggesting limited real-world threat despite the technical severity of SSRF vulnerabilities.
Technical Context
This SSRF vulnerability (CWE-918) affects the HETWORKS WordPress Image Shrinker plugin, which provides image optimization functionality for WordPress installations. SSRF flaws occur when an application fails to properly validate user-supplied input when constructing server-side HTTP requests, allowing attackers to manipulate the plugin into making requests to unintended destinations. In this context, the vulnerability likely resides in the image processing or download mechanism where the plugin fetches or processes images from URLs without adequate validation, potentially exposing internal services running on localhost, private cloud metadata endpoints, or other network-accessible systems.
Affected Products
WordPress Image Shrinker plugin by HETWORKS, versions through 1.1.0, is affected. The plugin is distributed via the WordPress plugin repository and installed on WordPress sites requiring image optimization functionality. Specific CPE data not provided in source materials, but affected installations can be identified through WordPress admin panels showing plugin version 1.1.0 or earlier.
Remediation
Update the WordPress Image Shrinker plugin to a version newer than 1.1.0 immediately through the WordPress admin dashboard (Plugins > Updates) or via direct download from the official WordPress plugin repository. Vendors typically release patched versions following vulnerability disclosure; consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/wp-image-shrinker/vulnerability/wordpress-wordpress-image-shrinker-plugin-1-1-0-server-side-request-forgery-ssrf-vulnerability for exact patched version availability and release timeline. If an immediate patch is unavailable, disable the plugin until an update is released to eliminate the attack surface entirely.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today