CVE-2025-28987: PressForward SSRF Vulnerability

CVE-2025-28987 Overview

CVE-2025-28987 is a Server-Side Request Forgery (SSRF) vulnerability in the PressForward WordPress plugin. The flaw affects all versions up to and including 5.9.5. An authenticated attacker with low privileges can coerce the WordPress server into issuing arbitrary HTTP requests to internal or external systems.

The vulnerability is categorized under CWE-918: Server-Side Request Forgery. Exploitation requires network access and low-privileged authentication, but no user interaction. Because the scope changes, the attack can affect resources beyond the vulnerable component.

Critical Impact
Attackers can pivot from the WordPress front end to internal-only services, cloud metadata endpoints, and other restricted network resources reachable by the host.

Affected Products

PressForward plugin for WordPress, all versions through 5.9.5
WordPress sites where PressForward is installed and activated
Hosting environments exposing internal services reachable by the WordPress host

Discovery Timeline

2025-08-14 - CVE-2025-28987 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-28987

Vulnerability Analysis

PressForward is a WordPress plugin used to aggregate and republish content from external feeds. The plugin fetches remote URLs on behalf of the site to import articles, media, and metadata.

CVE-2025-28987 exists because the plugin accepts user-controllable URLs and issues server-side requests to those destinations without adequate validation. An authenticated attacker with contributor-level access or similar can supply URLs pointing to internal network resources.

The request originates from the WordPress server, bypassing perimeter controls that block external clients. Attackers can enumerate internal hosts, probe cloud metadata services such as 169.254.169.254, or interact with unauthenticated internal APIs. Refer to the Patchstack SSRF Vulnerability Report for advisory-level detail.

Root Cause

The root cause is missing or insufficient validation of user-supplied URLs before the plugin invokes its HTTP client. The plugin does not enforce an allowlist of destinations, does not block private IP ranges (RFC 1918), and does not restrict URL schemes.

Without these controls, arbitrary hostnames and IP addresses reach the outbound request function, and the response content or timing feeds back to the attacker.

Attack Vector

The attacker authenticates to WordPress with a low-privileged account. They submit a crafted URL through a PressForward feature that triggers a remote fetch. The plugin resolves the hostname and issues an HTTP request from the WordPress host.

Typical targets include internal admin panels, database HTTP interfaces, container orchestration APIs, and cloud instance metadata services. On AWS EC2, accessing the metadata endpoint can disclose IAM role credentials when IMDSv1 is enabled.

No verified exploit code is publicly available. The vulnerability is described in prose based on the vendor and Patchstack advisories.

Detection Methods for CVE-2025-28987

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal RFC 1918 addresses or the 169.254.169.254 metadata endpoint
PressForward log entries showing fetches to unexpected hostnames or non-standard ports
WordPress access logs showing authenticated requests to PressForward endpoints followed by anomalous outbound traffic
Unexpected wp_remote_get or wp_remote_post calls originating from PressForward code paths

Detection Strategies

Correlate authenticated PressForward feature usage with subsequent outbound network connections from the web server
Alert on any web application requests targeting private IP space, loopback, or link-local addresses
Monitor for unusual URL schemes such as file://, gopher://, or dict:// submitted to PressForward endpoints
Baseline normal PressForward feed destinations and flag deviations

Monitoring Recommendations

Enable HTTP egress logging on WordPress hosts and forward logs to a centralized SIEM
Instrument the plugin's HTTP client wrapper to log destination URLs and response codes
Track authentication events for accounts with PressForward permissions
Review WordPress audit logs for creation of low-privileged accounts that could abuse this vector

How to Mitigate CVE-2025-28987

Immediate Actions Required

Update PressForward to a version later than 5.9.5 once the maintainers publish a fixed release
Audit WordPress user accounts and remove or restrict unnecessary low-privileged accounts with PressForward access
Enforce IMDSv2 on AWS EC2 instances hosting WordPress to prevent metadata credential theft
Restrict outbound network access from WordPress hosts to only required destinations

Patch Information

Refer to the Patchstack advisory for the current patch status. At the time of publication, versions through 5.9.5 are affected. Apply the vendor-supplied fix as soon as it is available through the WordPress plugin repository.

Workarounds

Deactivate the PressForward plugin until a patched version is available
Deploy an egress firewall or proxy that blocks WordPress from reaching private IP ranges and metadata endpoints
Use a Web Application Firewall (WAF) rule set to reject requests containing internal IPs or non-HTTP schemes in PressForward parameters
Restrict PressForward capabilities to trusted editorial staff only

bash

# Example iptables rules to block SSRF egress from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp -m owner --uid-owner www-data -j REJECT
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp -m owner --uid-owner www-data -j REJECT