CVE-2024-25915: Pexels Free Stock Photos SSRF Vulnerability

CVE-2024-25915 Overview

CVE-2024-25915 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] affecting the Raaj Trambadia Pexels: Free Stock Photos WordPress plugin. The flaw impacts all plugin versions up to and including 1.2.2. An authenticated attacker with low privileges can coerce the WordPress server into issuing arbitrary HTTP requests to internal or external destinations. This exposes internal services, cloud metadata endpoints, and other resources normally unreachable from the public network. The vulnerability is remotely exploitable over the network and can compromise confidentiality, integrity, and availability of the affected host.

Critical Impact
An authenticated attacker can abuse the plugin to reach internal services and cloud metadata endpoints, potentially retrieving credentials and pivoting deeper into the WordPress host environment.

Affected Products

Raaj Trambadia Pexels: Free Stock Photos WordPress plugin, versions up to and including 1.2.2
WordPress sites with the vulnerable plugin installed and activated
Hosting environments where the WordPress server can reach internal networks or cloud metadata services

Discovery Timeline

2024-02-23 - CVE-2024-25915 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-25915

Vulnerability Analysis

The Pexels: Free Stock Photos plugin integrates the Pexels stock imagery service into WordPress. To retrieve remote images, the plugin performs outbound HTTP requests on behalf of authenticated users. The vulnerability arises because the plugin accepts a user-controlled URL and issues a server-side request to that URL without validating the destination against an allowlist.

Because the request originates from the WordPress server, it bypasses network segmentation that would otherwise block direct client access. Attackers can direct the request to http://169.254.169.254/ cloud metadata endpoints on AWS, Azure, or GCP, to internal admin panels on private RFC1918 ranges, or to localhost services bound to the loopback interface. Response content, response headers, timing, and error messages may all leak information back to the attacker.

Root Cause

The root cause is missing validation of the destination URL passed to the plugin's server-side fetch routine. The plugin trusts input from an authenticated user and does not enforce scheme, host, or IP-range restrictions. This maps directly to CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires network access to the WordPress site and a low-privileged authenticated session such as a Subscriber, Contributor, or Author account. The attacker submits a crafted request containing a malicious target URL to the plugin's image-fetch handler. The server performs the outbound request and, depending on the code path, returns the response body or metadata to the attacker.

See the Patchstack SSRF Vulnerability Report for additional technical details.

Detection Methods for CVE-2024-25915

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to non-Pexels hosts, particularly 169.254.169.254, RFC1918 addresses, or 127.0.0.1
Web server access logs showing repeated requests to the plugin's AJAX or REST endpoints with unusual url parameters
Unexpected authenticated sessions from low-privilege WordPress accounts making rapid image-fetch calls

Detection Strategies

Inspect PHP-FPM and web server logs for the plugin's request handler being invoked with URL parameters that do not resolve to Pexels domains
Deploy a web application firewall (WAF) rule that blocks requests to plugin endpoints when the target URL parameter contains internal IP ranges or link-local addresses
Correlate WordPress authentication events with outbound network telemetry to identify newly registered accounts issuing SSRF probes

Monitoring Recommendations

Enable egress filtering and log all outbound HTTP requests originating from the WordPress host
Alert on any attempt from the web server to reach cloud instance metadata services or private network ranges
Monitor plugin directories for unauthorized file modifications following suspicious SSRF activity

How to Mitigate CVE-2024-25915

Immediate Actions Required

Deactivate and remove the Pexels: Free Stock Photos plugin until a patched release is confirmed installed
Restrict WordPress user registration and audit accounts with Subscriber, Contributor, or Author roles
Block outbound requests from the WordPress host to cloud metadata endpoints and internal management interfaces at the network layer

Patch Information

At the time of publication, no fixed version beyond 1.2.2 is listed in the referenced advisory. Site owners should monitor the Patchstack advisory and the WordPress plugin repository for an updated release, and apply it as soon as it becomes available.

Workarounds

Remove the plugin entirely if it is not essential to site operations
Enforce Instance Metadata Service Version 2 (IMDSv2) on AWS-hosted instances to require session tokens for metadata access
Configure the WordPress host firewall to deny outbound traffic to 169.254.169.254, 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16 except where explicitly required
Restrict access to /wp-admin/admin-ajax.php and REST endpoints associated with the plugin using a WAF or .htaccess rules

bash

# Example iptables egress rules to block SSRF targets from the WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j DROP