CVE-2025-49983: WPThumb WordPress Plugin SSRF Vulnerability

CVE-2025-49983 Overview

CVE-2025-49983 is a Server-Side Request Forgery (SSRF) vulnerability in the Joe Hoyle WPThumb WordPress plugin. The flaw affects all versions of wp-thumb up to and including 0.10. An authenticated attacker with low privileges can coerce the vulnerable WordPress server into issuing HTTP requests to attacker-controlled or internal destinations. The vulnerability is tracked under CWE-918 and is documented in the Patchstack Vulnerability Report.

Critical Impact
An authenticated attacker can abuse the WPThumb image-processing functionality to force the WordPress host to send crafted HTTP requests, potentially reaching internal services, cloud metadata endpoints, or non-public network resources.

Affected Products

Joe Hoyle WPThumb (wp-thumb) WordPress plugin
All versions from n/a through <= 0.10
WordPress installations that have WPThumb installed and activated

Discovery Timeline

2025-06-20 - CVE-2025-49983 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49983

Vulnerability Analysis

WPThumb is a WordPress plugin that resizes and processes images, including images fetched from remote URLs. The vulnerability allows an authenticated user with limited privileges to submit a URL that the plugin then dereferences server-side. Because the plugin does not adequately validate or restrict the destination of the outbound request, the WordPress host can be forced to contact arbitrary hosts, including internal-only endpoints.

Exploitation requires authentication and produces a scope change, meaning the impact extends beyond the vulnerable component to other resources reachable from the server. The vulnerability has a high attack complexity, reflecting conditions such as needing valid credentials and crafting a request the plugin will process.

Root Cause

The root cause is missing or insufficient validation of user-supplied URLs before the plugin issues an outbound HTTP request. The plugin trusts the caller-supplied destination and does not enforce an allowlist, block private IP ranges (RFC1918), block loopback and link-local ranges, or restrict schemes. This is a textbook CWE-918 pattern.

Attack Vector

An authenticated attacker submits a request to the WPThumb-driven endpoint containing a URL that points at an internal or otherwise restricted target. The WordPress server dereferences that URL and returns or processes the response. Attackers commonly target cloud instance metadata services (for example 169.254.169.254), internal admin panels, or unauthenticated internal APIs. The response body may or may not be returned to the attacker, but the request itself can be enough to trigger sensitive actions or map internal infrastructure.

No verified public exploit code is available. See the Patchstack Vulnerability Report for advisory details.

Detection Methods for CVE-2025-49983

Indicators of Compromise

Outbound HTTP requests from the WordPress host to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), loopback (127.0.0.0/8), or link-local (169.254.0.0/16) addresses.
Requests from the web server process to cloud metadata endpoints such as http://169.254.169.254/latest/meta-data/.
Access log entries showing authenticated users invoking WPThumb image-processing endpoints with unusual src or URL parameters.
Unexpected user-agent strings or connection attempts originating from PHP-FPM or the WordPress worker to internal services.

Detection Strategies

Inspect WordPress access logs for authenticated requests that pass fully qualified URLs to the WPThumb plugin.
Correlate PHP outbound network calls with the authenticated session that initiated them.
Deploy a Web Application Firewall (WAF) rule that flags requests to WPThumb endpoints containing URL-encoded IP literals, private ranges, or non-HTTP schemes.

Monitoring Recommendations

Monitor egress network traffic from web servers and alert on connections to RFC1918, loopback, and cloud metadata ranges.
Enable and centrally collect WordPress plugin activity logs and web server access logs.
Baseline normal outbound destinations for the WordPress host and alert on deviations.

How to Mitigate CVE-2025-49983

Immediate Actions Required

Inventory WordPress sites and identify any installation running the wp-thumb plugin at version 0.10 or earlier.
Deactivate and remove WPThumb where the functionality is not required.
Restrict authenticated account creation and audit existing low-privilege accounts for anomalous activity.
Block egress from WordPress hosts to internal-only ranges and cloud metadata endpoints at the network or host firewall level.

Patch Information

At the time of publication, no fixed version beyond 0.10 is listed in the advisory. Refer to the Patchstack Vulnerability Report for updates on a vendor patch. If no patched release is available, treat plugin removal as the primary remediation.

Workarounds

Remove the WPThumb plugin from affected WordPress installations until a fixed version is released.
Enforce network egress filtering that denies web-server outbound traffic to private, loopback, link-local, and cloud metadata ranges.
Require Instance Metadata Service Version 2 (IMDSv2) on AWS EC2 hosts to reduce SSRF exposure to instance credentials.
Place a WAF in front of WordPress and block requests to WPThumb endpoints containing URL parameters that reference internal addresses.

bash

# Example nginx egress restriction pattern (illustrative)
# Block outbound requests from the WordPress worker to metadata and RFC1918 ranges
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT