CVE-2025-12375: Printful WooCommerce Plugin SSRF Flaw

CVE-2025-12375 Overview

The Printful Integration for WooCommerce plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 2.2.11. The vulnerability exists within the advanced size chart REST API endpoint due to insufficient validation of user-supplied URLs before passing them to the download_url() function. This security flaw enables authenticated attackers with Contributor-level access or higher to make arbitrary web requests originating from the web application, potentially allowing them to query and modify information from internal services.

Critical Impact

Authenticated attackers can leverage this SSRF vulnerability to bypass network security controls, access internal services, and potentially exfiltrate sensitive data from backend systems not intended to be publicly accessible.

Affected Products

• Printful Integration for WooCommerce plugin versions up to and including 2.2.11
• WordPress installations running vulnerable plugin versions
• WooCommerce stores utilizing the Printful Integration plugin

Discovery Timeline

• February 19, 2026 - CVE-2025-12375 published to NVD
• February 19, 2026 - Last updated in NVD database

Technical Details for CVE-2025-12375

Vulnerability Analysis

This Server-Side Request Forgery vulnerability stems from inadequate URL validation within the Printful Integration for WooCommerce plugin's REST API controller. The vulnerability is classified under CWE-918 (Server-Side Request Forgery), which describes scenarios where an application fetches a remote resource using a user-controlled URL without proper validation.

The vulnerable code path exists within the size chart functionality, specifically in the class-printful-rest-api-controller.php and class-printful-size-guide.php files. When processing size chart requests through the REST API endpoint, the plugin accepts URLs from authenticated users and passes them directly to WordPress's download_url() function without adequate sanitization or validation.

The network-accessible attack vector with low complexity requirements means that any authenticated user with at least Contributor-level permissions can exploit this vulnerability. The changed scope indicates that the vulnerability can affect resources beyond the vulnerable component's security authority, allowing attackers to pivot from the WordPress application to internal network services.

Root Cause

The root cause of CVE-2025-12375 is improper input validation in the URL handling logic of the advanced size chart REST API endpoint. The plugin fails to implement proper URL scheme restrictions, domain allowlisting, or IP address validation before making server-side requests. This allows attackers to supply malicious URLs pointing to internal resources, cloud metadata endpoints, or other sensitive services that should not be accessible from the application layer.

Attack Vector

An attacker with authenticated access (Contributor role or above) can exploit this vulnerability by crafting malicious requests to the vulnerable REST API endpoint. The attack flow involves:

1. Authenticating to the WordPress site with at least Contributor-level privileges
2. Crafting a request to the advanced size chart REST API endpoint with a malicious URL parameter
3. Supplying URLs targeting internal network resources such as http://localhost, http://127.0.0.1, cloud metadata endpoints like http://169.254.169.254, or other internal services
4. The server processes the request and makes an outbound connection to the attacker-specified URL
5. Response data from internal services is potentially returned to the attacker or used to modify internal service configurations

The vulnerability allows both read and write operations against internal services, as indicated by the confidentiality and integrity impact ratings, though availability is not affected.

Detection Methods for CVE-2025-12375

Indicators of Compromise

• Unusual outbound HTTP requests from the WordPress server to internal IP ranges (127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
• Requests to cloud metadata endpoints such as 169.254.169.254 originating from the web application
• Suspicious REST API activity targeting the Printful size chart endpoints from Contributor-level accounts
• Unexpected data access patterns or modifications in internal services following WordPress REST API calls

Detection Strategies

• Monitor web server logs for REST API requests to /wp-json/ endpoints containing Printful-related paths with URL parameters pointing to internal addresses
• Implement network-level monitoring to detect outbound requests from the WordPress server to non-public IP ranges
• Review WordPress user activity logs for Contributor-level accounts making unusual REST API requests
• Deploy web application firewall rules to detect SSRF patterns in request parameters

Monitoring Recommendations

• Enable detailed logging for WordPress REST API endpoints, particularly those associated with the Printful Integration plugin
• Configure network egress monitoring to alert on connections to internal network ranges or cloud metadata services
• Implement anomaly detection for authenticated user behavior to identify potential exploitation attempts
• Establish baseline patterns for legitimate Printful plugin network activity to identify deviations

How to Mitigate CVE-2025-12375

Immediate Actions Required

• Update the Printful Integration for WooCommerce plugin to the latest patched version immediately
• Review WordPress user accounts with Contributor-level access or higher and temporarily restrict access if update cannot be immediately applied
• Audit recent REST API activity logs for signs of exploitation attempts
• Implement network egress filtering to prevent the WordPress server from connecting to internal services or cloud metadata endpoints

Patch Information

The vendor has released a security update to address this vulnerability. Administrators should update to the latest version of the Printful Integration for WooCommerce plugin available through the WordPress plugin repository. The WordPress Plugin Change Log contains details about the security fix. Additional technical analysis is available from Wordfence Vulnerability Analysis.

Workarounds

• If immediate patching is not possible, temporarily disable the Printful Integration for WooCommerce plugin until the update can be applied
• Implement web application firewall rules to block REST API requests containing internal IP addresses or localhost references in URL parameters
• Restrict user account access by auditing and removing Contributor-level permissions where not strictly necessary
• Configure network-level egress filtering to prevent the WordPress application from making outbound connections to internal network ranges

# Example: Block outbound connections to internal ranges using iptables
# Apply to WordPress server to prevent SSRF exploitation
iptables -A OUTPUT -d 127.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner www-data -j DROP
iptables -A OUTPUT -d 169.254.169.254/32 -m owner --uid-owner www-data -j DROP