CVE-2025-49418: Allmart Core SSRF Vulnerability

CVE-2025-49418 Overview

CVE-2025-49418 is a Server-Side Request Forgery (SSRF) vulnerability affecting the TeconceTheme Allmart WordPress plugin (allmart-core). The flaw allows unauthenticated remote attackers to coerce the WordPress server into issuing arbitrary HTTP requests to attacker-chosen destinations. All versions through 1.0.0 are affected.

The issue is tracked under CWE-918: Server-Side Request Forgery. Exploitation requires no privileges or user interaction and can be performed over the network. Attackers can leverage the vulnerability to probe internal network resources, access cloud metadata services, and reach systems otherwise inaccessible from the public internet.

Critical Impact
Unauthenticated attackers can pivot through vulnerable WordPress sites to reach internal services, cloud metadata endpoints, and otherwise unreachable backend infrastructure.

Affected Products

TeconceTheme Allmart (allmart-core) plugin for WordPress
All versions from initial release through 1.0.0
WordPress installations with the Allmart plugin enabled

Discovery Timeline

2025-07-04 - CVE-2025-49418 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49418

Vulnerability Analysis

The vulnerability resides in the allmart-core plugin component shipped with the Allmart WordPress theme ecosystem. The plugin accepts a user-supplied URL parameter and passes it to a server-side HTTP request function without validating the destination host or scheme.

Because the request originates from the WordPress server itself, attackers can target endpoints that trust the server's network position. This includes private RFC1918 subnets, link-local addresses such as 169.254.169.254 exposed by AWS, Azure, and GCP metadata services, and loopback-bound administrative interfaces.

The scope-changed nature of the flaw means a single vulnerable WordPress instance can become a proxy for attacking other systems within the hosting environment. Confidentiality and integrity impacts arise from response data leakage and the ability to interact with internal HTTP APIs.

Root Cause

The root cause is missing validation of user-controlled URL input before it is consumed by a server-side request mechanism. The plugin does not enforce an allowlist of permitted hosts, does not block private or reserved address ranges, and does not restrict supported URL schemes. See the Patchstack advisory for allmart-core for technical details.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a URL parameter pointing at an internal target. The WordPress server fetches that URL and may return part or all of the response body to the attacker. Common abuse patterns include reading cloud instance metadata, fingerprinting internal services, and reaching admin panels bound to localhost.

Detection Methods for CVE-2025-49418

Indicators of Compromise

Outbound HTTP requests from the WordPress server process to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or 169.254.169.254.
Web server access logs showing requests to allmart-core plugin endpoints with URL-encoded parameters containing http://, file://, or internal hostnames.
Unexpected DNS resolutions originating from the WordPress host targeting cloud metadata domains.

Detection Strategies

Inspect web access logs for query strings or POST bodies referencing external or internal URLs sent to wp-content/plugins/allmart-core/ paths.
Correlate PHP outbound connection telemetry with HTTP request patterns to identify SSRF-style fetches initiated by the plugin.
Apply WAF rules that flag URL-shaped parameters resolving to private address space when sent to WordPress plugin endpoints.

Monitoring Recommendations

Enable egress filtering and log all outbound traffic from web tier hosts; alert on connections to metadata service IPs.
Monitor process-level network activity from php-fpm or Apache worker processes for anomalous destinations.
Track plugin inventory across managed WordPress sites and alert when allmart-core version 1.0.0 or earlier is detected.

How to Mitigate CVE-2025-49418

Immediate Actions Required

Disable or uninstall the Allmart allmart-core plugin until a fixed version is released and verified.
Restrict outbound network access from WordPress hosts to only required external services using host or network firewalls.
Block access to cloud metadata endpoints from the web tier, or enforce IMDSv2 with hop-limit 1 on AWS instances.

Patch Information

At the time of publication, no patched version above 1.0.0 is referenced in the Patchstack advisory. Administrators should monitor the vendor's release channel and apply updates as soon as a fixed build is published.

Workarounds

Remove the allmart-core plugin directory from wp-content/plugins/ until a patch is available.
Place the WordPress site behind a Web Application Firewall configured to reject requests containing URL parameters targeting private IP ranges.
Enforce strict egress allowlisting at the network layer so SSRF attempts cannot reach internal services even if exploited.

bash

# Example egress restriction using iptables on a WordPress host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -p tcp --dport 443 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -p tcp --dport 80 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -p tcp --dport 80 -j DROP