Atomic Edge analysis of CVE-2025-14613 (metadata-based):
This vulnerability is an authenticated Server-Side Request Forgery (SSRF) in the GetContentFromURL WordPress plugin, version 1.0. The flaw resides in the plugin’s shortcode handler for the `[gcfu]` tag, which insecurely fetches remote content using a user-supplied URL. The CVSS score of 7.2 (High) reflects the network attack vector, low attack complexity, and impacts on confidentiality and integrity across security boundaries.

Atomic Edge research infers the root cause is improper input validation and the use of an unsafe HTTP client. The description confirms the plugin uses `wp_remote_get()` instead of `wp_safe_remote_get()` to process the ‘url’ attribute from the shortcode. This function choice does not restrict requests to internal network resources. The CWE-918 classification confirms the core issue is a failure to validate or sanitize user-controlled URLs before using them to initiate server-side HTTP requests. These conclusions are inferred from the CWE and standard WordPress patterns, as no source code diff is available for confirmation.

Exploitation requires an attacker to have Contributor-level access or higher to the WordPress site. The attacker can embed the `[gcfu]` shortcode into a post or page with a malicious ‘url’ attribute. When the post is viewed, the plugin’s shortcode callback executes `wp_remote_get()` on the supplied URL. Attackers can target internal HTTP services, such as metadata endpoints (e.g., http://169.254.169.254/), database admin panels, or other unexposed web applications. The payload is a simple shortcode: `[gcfu url=”http://internal-ip:port/path”]`.

Remediation requires replacing `wp_remote_get()` with `wp_safe_remote_get()` to block requests to internal IP addresses and localhost. The plugin should also implement an allowlist of permitted URL schemes (likely only http and https) and domains, or implement strong validation using `wp_http_validate_url()`. A capability check should confirm the user has the `unfiltered_html` permission to use the shortcode, though this is a secondary control. The primary fix is using the safe HTTP fetching function.

The impact of successful exploitation includes unauthorized access to internal services. Attackers can read sensitive data from cloud metadata services, interact with internal APIs, or perform attacks against adjacent systems. This can lead to information disclosure, internal network mapping, and in some cases, remote code execution if the internal service accepts malicious payloads. The scope change (S:C) in the CVSS vector indicates the vulnerability can affect resources beyond the vulnerable plugin itself.