CVE-2025-28963: URL Shortener SSRF Vulnerability

CVE-2025-28963 Overview

CVE-2025-28963 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Md Yeasin Ul Haider URL Shortener plugin (exact-links) for WordPress. The flaw impacts all versions up to and including 3.0.7. An unauthenticated attacker can coerce the WordPress server to issue arbitrary outbound HTTP requests to attacker-chosen destinations. This behavior can be abused to probe internal network resources, interact with cloud metadata services, or relay traffic through the vulnerable host. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Unauthenticated remote attackers can send crafted requests to the URL Shortener plugin to trigger server-side HTTP requests, exposing internal services and metadata endpoints not reachable from the public internet.

Affected Products

Md Yeasin Ul Haider URL Shortener (WordPress plugin exact-links)
All versions up to and including 3.0.7
WordPress installations with the vulnerable plugin activated

Discovery Timeline

2025-07-04 - CVE-2025-28963 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28963

Vulnerability Analysis

The URL Shortener plugin accepts a user-supplied URL and processes it server-side without adequate validation of the destination host. Because the plugin issues an outbound HTTP request to the supplied URL, an attacker controls where the WordPress server connects. The Exploit Prediction Scoring System (EPSS) reports a probability of 0.161% for this issue.

SSRF in a WordPress context is impactful because the site host frequently resides in an environment that trusts internal networks. Attackers can pivot from the public plugin endpoint to cloud metadata services such as 169.254.169.254, internal admin panels, or unauthenticated services bound to localhost.

Root Cause

The root cause is missing or insufficient validation of user-supplied URLs before the plugin performs an outbound HTTP request. The plugin does not enforce an allowlist of destination hosts, does not block private IP ranges, and does not restrict URL schemes. This maps directly to CWE-918.

Attack Vector

An unauthenticated attacker submits a crafted URL to the vulnerable plugin endpoint over the network. The WordPress server then fetches the attacker-specified resource, returning content or metadata that would otherwise be inaccessible. High attack complexity reflects conditions required to reach exploitable internal targets, but no privileges or user interaction are required.

Refer to the Patchstack WordPress Vulnerability Report for technical details of the vulnerable code path.

Detection Methods for CVE-2025-28963

Indicators of Compromise

Outbound HTTP requests from the WordPress host to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses such as 169.254.169.254.
Web server access logs showing repeated requests to exact-links plugin endpoints with URL parameters pointing to internal hosts or unusual schemes.
Unexpected DNS lookups originating from the PHP-FPM or web server process for attacker-controlled domains.

Detection Strategies

Inspect WordPress access logs for requests targeting the URL Shortener plugin that include URL parameters referencing localhost, private ranges, or cloud metadata endpoints.
Correlate inbound plugin requests with outbound HTTP egress from the WordPress host to identify SSRF chains.
Deploy web application firewall (WAF) rules that flag URL parameters resolving to non-public IP space.

Monitoring Recommendations

Monitor cloud instance metadata service (IMDS) access from the WordPress host and alert on any request lacking legitimate context.
Alert on new outbound connections from PHP worker processes to internal management ports such as 6379, 9200, 2375, or 8080.
Track version and file integrity of the exact-links plugin directory to detect unpatched or tampered installations.

How to Mitigate CVE-2025-28963

Immediate Actions Required

Deactivate and remove the URL Shortener (exact-links) plugin if a patched version is not yet available.
Restrict outbound egress from the WordPress host, denying connections to private IP ranges and cloud metadata endpoints where not required.
Enforce IMDSv2 on AWS-hosted WordPress instances to prevent credential theft via SSRF.

Patch Information

At the time of publication, no fixed version is listed in the referenced advisory beyond noting that versions <= 3.0.7 are affected. Site administrators should consult the Patchstack advisory for the latest fix status and upgrade guidance.

Workarounds

Block access to the vulnerable plugin endpoints at the web server or WAF layer until a patch is installed.
Apply egress firewall rules on the WordPress host that deny outbound requests to RFC1918 ranges and 169.254.169.254.
Run the WordPress application under a dedicated network segment with least-privilege access to internal services.

bash

# Example nginx snippet to block the vulnerable plugin path
location ~* /wp-content/plugins/exact-links/ {
    deny all;
    return 403;
}

# Example iptables egress restriction for the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -j REJECT