CVE-2025-30964: ThemeGoods Photography SSRF Vulnerability

CVE-2025-30964 Overview

CVE-2025-30964 is a Server-Side Request Forgery (SSRF) vulnerability in the ThemeGoods Photography WordPress theme. The issue affects all Photography theme versions up to and including 7.7.6. An unauthenticated attacker can coerce the vulnerable WordPress site to issue HTTP requests to arbitrary destinations. This can be leveraged to probe internal network resources, interact with cloud metadata services, or pivot against services otherwise unreachable from the internet. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated remote attacker can force the WordPress server to send arbitrary HTTP requests, enabling reconnaissance of internal services and potential access to cloud instance metadata endpoints.

Affected Products

ThemeGoods Photography WordPress theme versions up to and including 7.7.6
WordPress sites deploying the Photography theme without the vendor patch
Hosting environments running any prior Photography theme release (n/a through < 7.7.6)

Discovery Timeline

2025-04-15 - CVE-2025-30964 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-30964

Vulnerability Analysis

The Photography theme exposes functionality that fetches remote resources based on user-supplied input without adequate validation of the destination URL. An attacker submits a crafted URL parameter, and the theme's server-side code performs an outbound HTTP request to that address. Because the request originates from the WordPress host, it inherits the network trust of that server. Attackers can target 127.0.0.1, private RFC1918 ranges, or cloud metadata endpoints such as 169.254.169.254. The response content and timing can be used to enumerate internal services even when the response is not returned directly to the attacker.

Root Cause

The root cause is missing or insufficient allow-list validation on URLs consumed by a server-side fetch routine in the Photography theme. The code does not restrict schemes, hosts, or IP ranges before invoking the HTTP client. This maps to CWE-918, where a web application accepts a URL and dereferences it without ensuring the destination is safe.

Attack Vector

Exploitation occurs over the network without authentication. An attacker sends an HTTP request to the vulnerable endpoint containing an attacker-controlled URL. The WordPress server then issues an outbound request to that URL. Successful exploitation requires the attacker to know or guess the vulnerable parameter path, which raises attack complexity. Refer to the Patchstack advisory for advisory-level details.

No verified proof-of-concept code is available. See the Patchstack advisory for technical details.

Detection Methods for CVE-2025-30964

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or link-local addresses (169.254.0.0/16)
Requests originating from wp-content/themes/photography/ handlers containing URL-shaped query parameters
Unexpected DNS queries from the WordPress host to attacker-controlled domains
Access log entries with URL parameters containing http://, https://, file://, or gopher:// schemes

Detection Strategies

Inspect web server access logs for requests to Photography theme endpoints that carry URL-valued parameters pointing to internal or metadata addresses
Correlate inbound HTTP requests with outbound connections from the PHP process within the same time window
Deploy a WAF rule that flags URL parameters resolving to private, loopback, or link-local IP ranges

Monitoring Recommendations

Monitor egress traffic from web servers and alert on connections to cloud metadata endpoints such as 169.254.169.254
Log all PHP curl_exec, file_get_contents, and wp_remote_get invocations where feasible for post-incident analysis
Track theme file integrity and alert on unauthorized modifications to files under wp-content/themes/photography/

How to Mitigate CVE-2025-30964

Immediate Actions Required

Identify all WordPress installations using the ThemeGoods Photography theme and confirm the installed version
Upgrade the Photography theme to a version above 7.7.6 once the vendor publishes a fixed release
Restrict outbound network access from the WordPress server to only required destinations at the firewall or cloud security group level
Enable IMDSv2 on AWS-hosted instances to require session tokens for metadata access

Patch Information

Consult the Patchstack advisory for the Photography theme SSRF vulnerability for the current patch status and vendor-supplied remediation. Apply the fixed theme version from the ThemeGoods vendor when available.

Workarounds

Deploy a WAF rule that blocks requests to Photography theme endpoints containing URL parameters targeting private, loopback, or metadata IP addresses
Configure egress filtering to prevent the WordPress host from reaching internal subnets and 169.254.169.254
Temporarily disable the Photography theme and switch to a maintained theme if patching is not immediately possible

bash

# Example egress restriction using iptables to block metadata endpoint access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP