CVE-2025-1912 Overview
CVE-2025-1912 is a Server-Side Request Forgery (SSRF) vulnerability [CWE-918] in the Product Import Export for WooCommerce – Import Export Product CSV Suite plugin for WordPress. The flaw affects all versions up to and including 2.5.0. The vulnerable validate_file() function fails to restrict the destinations of outbound web requests. Authenticated attackers with Administrator-level access can coerce the WordPress server into issuing arbitrary HTTP requests. This enables interaction with internal services that are otherwise unreachable from the public internet.
Critical Impact
Authenticated administrators can leverage the vulnerable validate_file() function to pivot into internal networks, query cloud metadata endpoints, and reach unauthenticated internal services.
Affected Products
- WebToffee Product Import Export for WooCommerce plugin versions ≤ 2.5.0
- WordPress sites running the Import Export Product CSV Suite
- WooCommerce installations using the affected plugin for product imports
Discovery Timeline
- 2025-03-26 - CVE-2025-1912 published to the National Vulnerability Database
- 2025-07-09 - Last updated in NVD database
Technical Details for CVE-2025-1912
Vulnerability Analysis
The vulnerability resides in the validate_file() function within admin/modules/import/classes/class-import-ajax.php. The function accepts a user-supplied file location and processes it without restricting the scheme or destination host. When supplied with a URL, the plugin issues a server-side HTTP request to fetch the resource. No allowlist or network-boundary check filters internal IP ranges, loopback addresses, or cloud metadata endpoints.
The SSRF reaches resources inside the trust boundary of the hosting environment. On cloud-hosted WordPress instances, this includes the AWS instance metadata service at 169.254.169.254, GCP metadata endpoints, and internal management APIs. Attackers can enumerate internal services, retrieve configuration data, and in some cases modify resources exposed by unauthenticated internal endpoints.
Exploitation requires Administrator privileges, which raises the bar for direct external attack. The condition becomes relevant in multi-tenant WordPress hosting, in scenarios where lower-privileged accounts can escalate, or in compromised administrator session chains.
Root Cause
The import handler treats remote file inputs as trusted and passes them directly to an HTTP fetch routine. The plugin lacks URL scheme validation, hostname resolution checks, and a deny list for private RFC 1918 ranges and link-local addresses.
Attack Vector
An authenticated administrator submits a crafted CSV import request to the plugin's AJAX endpoint. The supplied file URL points to an internal address rather than an external CSV. The vulnerable validate_file() function dispatches the request from the WordPress server, and response content or timing differences disclose information about internal services. See the WordPress Plugin Code Review for the affected source line and the Wordfence Vulnerability Report for additional analysis.
Detection Methods for CVE-2025-1912
Indicators of Compromise
- Outbound HTTP connections from the WordPress PHP worker process to 169.254.169.254, 127.0.0.1, or RFC 1918 ranges
- AJAX requests to admin-ajax.php with action parameters tied to the Product Import Export plugin containing non-CSV URLs
- WordPress access logs showing administrator-initiated import jobs targeting unusual hostnames
- Anomalous HTTP response sizes or status codes returned by the plugin import workflow
Detection Strategies
- Monitor PHP-FPM and web server egress traffic for connections to private address space originating from import workflows
- Inspect WordPress audit logs for use of the validate_file() code path with URL inputs rather than uploaded file inputs
- Correlate administrator account activity with outbound network requests in adjacent time windows
Monitoring Recommendations
- Enable WordPress security plugin logging to capture all administrator import actions and the parameters submitted
- Forward web server, PHP error, and egress firewall logs to a centralized SIEM for cross-source correlation
- Alert on any HTTP request from the web server to cloud metadata endpoints, which has no legitimate use case for a content management system
How to Mitigate CVE-2025-1912
Immediate Actions Required
- Upgrade the Product Import Export for WooCommerce plugin to a version newer than 2.5.0 that contains the fix referenced in the WordPress Changeset Log
- Audit existing administrator accounts and revoke unused or stale privileged sessions
- Restrict outbound network access from the WordPress host to only required destinations using host or network firewall rules
Patch Information
The vendor addressed the vulnerability in the changeset published at plugins.trac.wordpress.org changeset 3261194. Administrators should update through the WordPress plugin manager and confirm the installed version exceeds 2.5.0. Review the WordPress Plugin Developer Info page for the current release.
Workarounds
- Block egress traffic from the WordPress server to 169.254.169.254 and RFC 1918 ranges at the firewall layer when those destinations are not required
- Apply Instance Metadata Service Version 2 (IMDSv2) on AWS instances to require session-token requests that simple SSRF payloads cannot produce
- Temporarily disable the Product Import Export plugin until the patched version is deployed
- Limit Administrator-role assignments and enforce multi-factor authentication on all privileged WordPress accounts
# Example egress restriction using iptables to block AWS IMDS access from the web server
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
