CVE-2025-11917: WPeMatico RSS Feed Fetcher SSRF Vulnerability

CVE-2025-11917 Overview

CVE-2025-11917 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the WPeMatico RSS Feed Fetcher plugin for WordPress. The flaw affects all plugin versions up to and including 2.8.11. The vulnerability resides in the wpematico_test_feed() function, which does not adequately validate the destination of feed requests. Authenticated attackers with Subscriber-level access or higher can force the WordPress server to issue HTTP requests to arbitrary internal or external hosts. This enables querying and modifying information exposed by internal services that trust the WordPress server's network position.

Critical Impact
Authenticated users with minimal privileges can pivot the WordPress server into internal networks, reaching cloud metadata endpoints and other internal services normally shielded from external callers.

Affected Products

WPeMatico RSS Feed Fetcher plugin for WordPress, versions through 2.8.11
WordPress sites permitting Subscriber-level or higher registrations with the plugin installed
Any environment where the WordPress host has network access to internal services

Discovery Timeline

2025-11-05 - CVE-2025-11917 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11917

Vulnerability Analysis

The WPeMatico plugin exposes an AJAX action named wpematico_test_feed that lets users preview RSS feeds during campaign configuration. The handler wpematico_test_feed() accepts a user-supplied url parameter and issues an HTTP request from the WordPress server. The plugin performs the request without restricting the target to external RSS endpoints or blocking internal address ranges. As a result, an authenticated attacker can supply URLs pointing to loopback interfaces, private RFC1918 ranges, cloud instance metadata services, or internal admin panels. The server returns response content or error signals that the attacker can use to enumerate internal infrastructure. The response channel is sufficient for reading unauthenticated internal APIs and, in some cases, invoking state-changing endpoints reachable via GET.

Root Cause

The root cause is missing URL validation and network egress filtering inside wpematico_test_feed() (see app/wpematico_functions.php around lines 1249 and 1260). The function trusted the url parameter and issued a server-side fetch without an allowlist, DNS resolution check, or restriction on target hosts. A related weakness was insufficient CSRF protection on the AJAX endpoint, which the vendor addressed by introducing a wpematico_test_feed_nonce.

Attack Vector

An attacker registers or authenticates as a Subscriber, obtains the plugin's AJAX nonce where required, and invokes the wpematico_test_feed action with a crafted url value. The WordPress server then issues a request to the attacker-chosen destination, returning body or timing signals that enable internal reconnaissance and data retrieval.

php

// Vendor patch excerpt - app/campaign_edit.php
// Introduces a nonce for the test-feed AJAX action
$wpematico_object = array(
    'test_nonce'                => wp_create_nonce('wpematico_test_feed_nonce'),
    'text_dismiss_this_notice'  => __('Dismiss this notice.', 'wpematico'),
    'text_type_some_feed_url'   => __('Type some feed URL.', 'wpematico'),
);
// Source: https://github.com/etruel/wpematico/commit/7a281dcfc0868490d62caee54f3b743708fed7cf

javascript

// Vendor patch excerpt - app/js/campaign_edit.js
// Attaches the nonce to the outbound AJAX request
var data = {
    action: "wpematico_test_feed",
    nonce: wpematico_object.test_nonce,
    url: feed,
    'cookie': encodeURIComponent(document.cookie)
};
// Source: https://github.com/etruel/wpematico/commit/7a281dcfc0868490d62caee54f3b743708fed7cf

Detection Methods for CVE-2025-11917

Indicators of Compromise

POST requests to wp-admin/admin-ajax.php containing action=wpematico_test_feed originating from low-privilege user sessions.
Outbound HTTP requests from the WordPress host to internal ranges such as 127.0.0.1, 169.254.169.254, 10.0.0.0/8, or 192.168.0.0/16.
User-Agent strings associated with WordPress HTTP APIs targeting non-RSS endpoints.

Detection Strategies

Inspect web server logs for admin-ajax.php calls invoking wpematico_test_feed with url values that do not resolve to public RSS feeds.
Correlate WordPress user role (Subscriber or higher) with test-feed invocation frequency to identify abusive accounts.
Alert on DNS resolution from the WordPress host to metadata or loopback destinations shortly after AJAX requests.

Monitoring Recommendations

Enable egress monitoring on WordPress servers and block traffic to cloud metadata endpoints unless explicitly required.
Track new user registrations and role assignments to detect account creation preceding exploitation attempts.
Review the Wordfence Vulnerability Report for updated signatures.

How to Mitigate CVE-2025-11917

Immediate Actions Required

Update the WPeMatico RSS Feed Fetcher plugin to a version later than 2.8.11 that includes the fix from GitHub Commit 7a281dcf.
Audit WordPress user accounts and remove untrusted Subscriber-level users on sites with the plugin installed.
Restrict WordPress server egress with a firewall policy that blocks access to internal ranges and cloud metadata IPs.

Patch Information

The vendor addressed the issue in the upstream repository with commit 7a281dcf, which introduces the wpematico_test_feed_nonce and hardens the AJAX handler. Site administrators should upgrade via the WordPress plugin manager once the fixed release is available. See the WordPress Plugin Functions Code reference for the vulnerable code location.

Workarounds

Disable the WPeMatico plugin until it can be updated to a patched release.
Close open user registration or force new registrations into a role below Subscriber where feasible.
Deploy a web application firewall rule that blocks action=wpematico_test_feed requests carrying non-HTTP(S) schemes or private-address URLs.

bash

# Example egress restriction using iptables on the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j REJECT