CVE-2025-47664: ThimPress WP Pipes SSRF Vulnerability

CVE-2025-47664 Overview

CVE-2025-47664 is a Server-Side Request Forgery (SSRF) vulnerability in the ThimPress WP Pipes plugin for WordPress. The flaw affects all versions up to and including 1.4.2. An authenticated attacker with high privileges can coerce the WordPress server into issuing arbitrary HTTP requests to internal or external resources. The vulnerability is tracked under CWE-918 (Server-Side Request Forgery).

Critical Impact
Authenticated attackers can abuse WP Pipes to pivot into internal network segments, reach cloud metadata endpoints, and exfiltrate sensitive data accessible to the WordPress host.

Affected Products

ThimPress WP Pipes plugin for WordPress
All versions from n/a through 1.4.2
WordPress sites with WP Pipes installed and active

Discovery Timeline

2025-05-07 - CVE-2025-47664 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47664

Vulnerability Analysis

WP Pipes is a WordPress plugin that aggregates and transforms data from external feeds. The vulnerability resides in request-handling logic that accepts user-supplied URLs without sufficient validation of the destination host. An attacker with elevated privileges can supply arbitrary URLs that the server fetches on their behalf.

The attack requires network access and high privileges but no user interaction. Successful exploitation enables access to resources that are normally shielded from the public internet. These include internal admin panels, cloud instance metadata services, and loopback-bound services.

Root Cause

The root cause is improper validation of outbound request destinations within the plugin's data-ingestion routines. WP Pipes trusts input URLs and does not restrict access to private IP ranges, link-local addresses, or non-HTTP schemes. This matches the pattern described by CWE-918.

Attack Vector

An authenticated user with sufficient plugin permissions submits a crafted URL through a WP Pipes configuration or feed endpoint. The server then issues a request to that URL and may return response data to the attacker. Attackers typically target http://169.254.169.254/ for cloud metadata, http://127.0.0.1/ for local services, or RFC 1918 ranges for lateral reconnaissance.

No public proof-of-concept exploit is listed for this CVE. Technical details are documented in the Patchstack WordPress SSRF Vulnerability advisory.

Detection Methods for CVE-2025-47664

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal RFC 1918 addresses or 127.0.0.1
Server-originated requests to cloud metadata endpoints such as 169.254.169.254
Unusual entries in WP Pipes feed configurations referencing non-public hostnames
Spikes in outbound traffic correlated with authenticated WP Pipes administrative sessions

Detection Strategies

Inspect WordPress access and PHP error logs for WP Pipes requests originating from administrative accounts
Correlate authenticated plugin activity with outbound firewall logs to identify SSRF probing patterns
Deploy web application firewall rules that flag feed URLs containing private IP ranges or metadata hostnames

Monitoring Recommendations

Enable egress logging on the WordPress host and alert on connections to internal subnets, loopback, and cloud metadata IPs
Monitor WP Pipes plugin configuration changes through file integrity monitoring on wp-content/plugins/wp-pipes/
Track administrative session activity in WordPress audit logs and correlate with network telemetry

How to Mitigate CVE-2025-47664

Immediate Actions Required

Update WP Pipes to a version later than 1.4.2 once a patched release is published by ThimPress
Audit WordPress accounts with privileges to configure WP Pipes feeds and remove unnecessary access
Review existing WP Pipes feed URLs for references to internal or metadata endpoints
Apply virtual patching through a web application firewall if an upstream fix is not yet available

Patch Information

The advisory published by Patchstack identifies version 1.4.2 as vulnerable. Administrators should consult the Patchstack WordPress SSRF Vulnerability advisory and the ThimPress plugin changelog for the fixed version and upgrade guidance.

Workarounds

Restrict outbound traffic from the WordPress server to only required external endpoints at the firewall or egress proxy
Block the WordPress host from reaching cloud metadata services (for example, 169.254.169.254) using IAM or network policies
Temporarily deactivate the WP Pipes plugin until a vendor patch is applied
Enforce least-privilege role assignments to limit which users can modify WP Pipes configurations

bash

# Example iptables rules to block metadata and loopback SSRF targets from the WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP