What is the CVSS score of CVE-2025-9975?

CVE-2025-9975 has a CVSS 3.1 base score of 6.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-9975

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2025-10-11 security@wordfence.com

WordPress SSRF

6.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.8 MEDIUM

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Oct 11, 2025 - 10:15 nvd

MEDIUM 6.8

DescriptionCVE.org

The WP Scraper plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.8.1 via the wp_scraper_extract_content function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. On Cloud instances, this issue allows for metadata retrieving.

AnalysisAI

Server-Side Request Forgery (SSRF) in WP Scraper WordPress plugin versions up to 5.8.1 allows authenticated administrators to make arbitrary web requests from the affected server, enabling reconnaissance of internal services, metadata theft on cloud instances, and potential information disclosure. The vulnerability exists in the wp_scraper_extract_content function and requires high-level administrative privileges to exploit, making it a post-authentication lateral movement and reconnaissance vector for compromised administrator accounts.

Technical ContextAI

The vulnerability is a classic Server-Side Request Forgery (CWE-918) flaw in the wp_scraper_extract_content function within the WP Scraper plugin. SSRF vulnerabilities occur when an application accepts user-controlled input for URLs or endpoints without sufficient validation, allowing attackers to craft requests that originate from the server itself rather than the client. In this case, an authenticated administrator can specify arbitrary URLs for the plugin to fetch, bypassing network-level access controls that would normally restrict a user's machine from accessing internal resources. On cloud environments (AWS, GCP, Azure), this is particularly dangerous because attackers can access instance metadata services (typically available at 169.254.169.254 or similar non-routable addresses) to retrieve credentials, API keys, and role information. The plugin's CPE context (WordPress plugin ecosystem) indicates this affects WordPress installations running versions up to 5.8.1 of the WP Scraper plugin.

Affected ProductsAI

WP Scraper WordPress plugin all versions up to and including 5.8.1. This affects any WordPress installation with the WP Scraper plugin active. The vulnerability is confirmed in the plugin's official repository at plugins.trac.wordpress.org, specifically in the wp_scraper.php file at line 688 (wp_scraper_extract_content function). Organizations should identify all WordPress instances running WP Scraper versions 5.8.1 or earlier by checking the plugin directory in WordPress admin or via wp-cli.

RemediationAI

Update the WP Scraper plugin to a patched version released after 5.8.1. Check the WordPress plugin repository or Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/4c72abf9-f63d-4460-8c9b-10e3f65b71ba) for the specific fix version. In the interim, restrict WP Scraper administrator access to only trusted users, and implement network-level controls (firewall rules, security groups) to prevent the WordPress server from accessing internal services or cloud metadata endpoints (e.g., block 169.254.169.254 egress on cloud instances). Audit recent changes made via WP Scraper by reviewing plugin activity logs and WordPress audit trails to identify any unauthorized SSRF exploitation attempts.