Wordpress Plugin
CVE-2025-69014
MEDIUM
Severity by source
AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.
AnalysisAI
Server-Side Request Forgery (SSRF) in Youzify WordPress plugin through version 1.3.7 allows authenticated high-privilege users to make arbitrary network requests from the server, exposing internal resources and services. The vulnerability requires administrative credentials (PR:H) but carries high confidentiality impact with EPSS score of 0.04% indicating minimal real-world exploitation likelihood despite the moderate CVSS score of 4.9.
Technical ContextAI
This vulnerability exploits improper validation of user-supplied input in network request handling (CWE-918: Server-Side Request Forgery), a common flaw in WordPress plugins that fail to sanitize URLs or endpoints before passing them to backend HTTP libraries. The Youzify plugin, which extends WordPress community features, likely contains functions that fetch remote content or interact with external services without adequate input validation. Attackers with admin-level privileges can manipulate request parameters to force the server to make requests to internal addresses (127.0.0.1, internal IP ranges) or private cloud metadata endpoints (e.g., AWS EC2 metadata service at 169.254.169.254), potentially disclosing sensitive configuration data, API keys, or internal service credentials.
Affected ProductsAI
Youzify WordPress plugin versions from an unspecified initial release through version 1.3.7 are affected. The WordPress plugin ecosystem identifier suggests this applies to Youzify as distributed through wordpress.org and derivative sources. Affected users running Youzify version 1.3.7 or earlier on any WordPress installation should update immediately.
RemediationAI
Update Youzify to a version newer than 1.3.7 as released by the vendor. Organizations should verify the patched version number through the official WordPress plugin repository or the vendor's advisory at https://patchstack.com/database/Wordpress/Plugin/youzify/vulnerability/wordpress-youzify-plugin-1-3-5-server-side-request-forgery-ssrf-vulnerability?_s_id=cve. As an interim control pending patch deployment, restrict administrator role assignment to trusted users only, since exploitation requires high-privilege credentials. Implement network-level egress filtering to restrict server outbound requests to only necessary external services, which would mitigate SSRF impact even if the vulnerability exists.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today