CVE-2025-9975
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N
Lifecycle Timeline
2Description
The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.
Analysis
Server-Side Request Forgery (SSRF) in WP Scraper WordPress plugin versions up to 5.8.1 allows authenticated administrators to make arbitrary web requests from the affected server, enabling reconnaissance of internal services, metadata theft on cloud instances, and potential information disclosure. The vulnerability exists in the wp_scraper_extract_content function and requires high-level administrative privileges to exploit, making it a post-authentication lateral movement and reconnaissance vector for compromised administrator accounts.
Technical Context
The vulnerability is a classic Server-Side Request Forgery (CWE-918) flaw in the wp_scraper_extract_content function within the WP Scraper plugin. SSRF vulnerabilities occur when an application accepts user-controlled input for URLs or endpoints without sufficient validation, allowing attackers to craft requests that originate from the server itself rather than the client. In this case, an authenticated administrator can specify arbitrary URLs for the plugin to fetch, bypassing network-level access controls that would normally restrict a user's machine from accessing internal resources. On cloud environments (AWS, GCP, Azure), this is particularly dangerous because attackers can access instance metadata services (typically available at 169.254.169.254 or similar non-routable addresses) to retrieve credentials, API keys, and role information. The plugin's CPE context (WordPress plugin ecosystem) indicates this affects WordPress installations running versions up to 5.8.1 of the WP Scraper plugin.
Affected Products
WP Scraper WordPress plugin all versions up to and including 5.8.1. This affects any WordPress installation with the WP Scraper plugin active. The vulnerability is confirmed in the plugin's official repository at plugins.trac.wordpress.org, specifically in the wp_scraper.php file at line 688 (wp_scraper_extract_content function). Organizations should identify all WordPress instances running WP Scraper versions 5.8.1 or earlier by checking the plugin directory in WordPress admin or via wp-cli.
Remediation
Update the WP Scraper plugin to a patched version released after 5.8.1. Check the WordPress plugin repository or Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4c72abf9-f63d-4460-8c9b-10e3f65b71ba) for the specific fix version. In the interim, restrict WP Scraper administrator access to only trusted users, and implement network-level controls (firewall rules, security groups) to prevent the WordPress server from accessing internal services or cloud metadata endpoints (e.g., block 169.254.169.254 egress on cloud instances). Audit recent changes made via WP Scraper by reviewing plugin activity logs and WordPress audit trails to identify any unauthorized SSRF exploitation attempts.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today