CVE-2025-48294: FG Drupal to WordPress SSRF Vulnerability

CVE-2025-48294 Overview

CVE-2025-48294 is a Server-Side Request Forgery (SSRF) vulnerability in the Kerfred FG Drupal to WordPress plugin for WordPress. The flaw affects all versions from unspecified initial releases up to and including 3.90.0. The plugin, used to migrate Drupal content into WordPress, fails to properly validate URLs it fetches on behalf of authenticated users. An attacker with high privileges can coerce the server to issue requests to unintended internal or external destinations, potentially exposing internal services or metadata endpoints [CWE-918].

Critical Impact
Authenticated high-privilege users can abuse the plugin to trigger server-initiated HTTP requests to arbitrary destinations, enabling internal reconnaissance and limited information disclosure across trust boundaries.

Affected Products

Kerfred FG Drupal to WordPress plugin versions up to and including 3.90.0
WordPress sites running the fg-drupal-to-wp migration plugin
Any WordPress deployment where high-privileged users can invoke the plugin's import functionality

Discovery Timeline

2025-07-16 - CVE-2025-48294 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48294

Vulnerability Analysis

The vulnerability resides in the plugin's import workflow, which accepts a user-supplied URL pointing to a Drupal source instance. The plugin then performs server-side HTTP requests to that URL to retrieve content for migration. Because the destination URL is not restricted to safe hosts, an attacker can supply URLs pointing to internal network resources, loopback addresses, or cloud metadata services. The impact scope changes across a trust boundary, allowing the server to interact with resources the attacker cannot reach directly. Confidentiality and integrity impact are limited, and availability is not affected.

Root Cause

The root cause is missing validation of user-controlled request targets before the plugin issues outbound HTTP requests. The plugin does not enforce an allowlist of hostnames, block private IP ranges (RFC 1918, loopback, link-local), or reject redirects to internal endpoints. This maps directly to CWE-918: Server-Side Request Forgery.

Attack Vector

Exploitation requires network access and high privileges within the WordPress instance, such as an administrator role capable of executing plugin import actions. The attacker submits a crafted source URL through the plugin's import interface. The WordPress server then issues an outbound request to that URL, returning response data or side-channel signals that the attacker can observe. Attack complexity is high because the attacker must already hold elevated privileges and craft a target reachable from the server context. See the Patchstack SSRF Vulnerability Report for advisory details.

Detection Methods for CVE-2025-48294

Indicators of Compromise

Outbound HTTP requests originating from the WordPress PHP worker process to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or 127.0.0.0/8.
Requests from the WordPress host to cloud metadata endpoints such as 169.254.169.254.
Unexpected entries in the plugin's import logs referencing non-Drupal hostnames or IP literals.

Detection Strategies

Inspect web server access and error logs for POST requests to wp-admin/admin.php with page=fg-drupal-to-wp parameters containing crafted URL values.
Correlate administrator session activity with outbound network flows from the web server to non-public destinations.
Alert on any outbound connection from WordPress hosts to link-local, loopback, or private RFC 1918 ranges.

Monitoring Recommendations

Enable egress filtering telemetry for all WordPress servers and forward flow logs to a centralized SIEM for analysis.
Monitor administrator role assignments and audit which accounts hold plugin execution privileges.
Track plugin version inventory across WordPress fleets and alert when fg-drupal-to-wp versions at or below 3.90.0 are observed.

How to Mitigate CVE-2025-48294

Immediate Actions Required

Identify all WordPress instances running the fg-drupal-to-wp plugin and confirm the installed version.
Restrict administrator accounts to trusted personnel and enforce multi-factor authentication on high-privilege roles.
Apply egress network controls that block WordPress hosts from reaching internal management ranges and cloud metadata endpoints.

Patch Information

At the time of publication, the advisory references vulnerable versions through 3.90.0. Administrators should consult the Patchstack SSRF Vulnerability Report and the vendor's WordPress.org plugin page for the latest fixed release. Update to the patched version as soon as it is available and validated in a staging environment.

Workarounds

Deactivate and remove the fg-drupal-to-wp plugin when active migrations are not in progress.
Deploy a web application firewall rule that blocks requests to plugin endpoints containing URL parameters targeting private IP literals or metadata hostnames.
Configure PHP or upstream proxy controls to prevent outbound requests from WordPress workers to internal address space.

bash

# Configuration example: egress restriction with iptables on the WordPress host
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT