CVE-2025-49984: PowerPress Podcasting SSRF Vulnerability

CVE-2025-49984 Overview

CVE-2025-49984 is a Server-Side Request Forgery (SSRF) vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress. The flaw affects all plugin versions up to and including 11.13.11. Authenticated attackers with low privileges can coerce the WordPress server into issuing HTTP requests to attacker-chosen destinations. The vulnerability is tracked under CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can pivot through the WordPress host to reach internal services, cloud metadata endpoints, or otherwise unreachable network resources.

Affected Products

Blubrry PowerPress Podcasting plugin for WordPress
All versions from initial release through 11.13.11
WordPress sites running the vulnerable plugin with authenticated user access

Discovery Timeline

2025-06-20 - CVE-2025-49984 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49984

Vulnerability Analysis

The PowerPress Podcasting plugin exposes functionality that fetches remote resources on behalf of the server. Insufficient validation of user-supplied URLs allows an authenticated attacker to redirect these outbound requests to arbitrary hosts. Successful exploitation abuses the WordPress server as a proxy to reach internal-only endpoints.

Exploitation carries higher attack complexity and requires low-privilege authentication. The scope is marked as changed, indicating the vulnerability affects resources beyond the vulnerable component itself. Confidentiality and integrity impact are limited, while availability is not directly affected.

The EPSS probability sits at 0.189%, reflecting a low but non-zero likelihood of exploitation activity. No public proof-of-concept exploit is currently referenced in the NVD entry.

Root Cause

The root cause is improper validation and sanitization of URL parameters passed to server-side HTTP request functions inside the plugin. The plugin does not enforce an allowlist of destinations, does not filter internal IP ranges (RFC 1918, loopback, link-local), and does not restrict URL schemes. This omission maps directly to CWE-918.

Attack Vector

An authenticated user submits a crafted URL through a plugin endpoint that performs a server-side fetch. The WordPress server issues the outbound request, returning response data or side effects to the attacker. Typical SSRF targets include:

Cloud instance metadata services such as http://169.254.169.254/
Internal administrative interfaces on 127.0.0.1 or private RFC 1918 ranges
Non-HTTP services reachable via alternative URL schemes

No verified exploitation code is published for this CVE. Refer to the Patchstack advisory for advisory-level detail.

Detection Methods for CVE-2025-49984

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP worker process to internal IP ranges, 127.0.0.1, or cloud metadata endpoints such as 169.254.169.254
Unusual authenticated POST or GET requests to PowerPress plugin endpoints containing URL parameters pointing to non-podcast hosts
Web server access logs showing PowerPress admin-ajax or REST routes invoked with http://, https://, file://, or gopher:// payloads

Detection Strategies

Inspect WordPress access logs for requests to PowerPress plugin URLs correlated with subsequent outbound connections from the server
Monitor egress traffic from web hosts for connections targeting metadata services or internal management interfaces
Compare installed PowerPress plugin versions across the fleet against the fixed release

Monitoring Recommendations

Alert on any outbound connection from WordPress hosts to link-local addresses (169.254.0.0/16) or loopback
Baseline expected outbound destinations from WordPress workers and alert on deviations
Enable WordPress audit logging to capture authenticated actions against PowerPress endpoints

How to Mitigate CVE-2025-49984

Immediate Actions Required

Upgrade the Blubrry PowerPress Podcasting plugin to a version above 11.13.11 once the vendor publishes a fixed release
Audit WordPress user accounts and revoke unnecessary contributor-or-higher privileges that could satisfy the low-privilege prerequisite
Review web server and application logs for prior SSRF attempts targeting PowerPress endpoints

Patch Information

Refer to the Patchstack advisory for CVE-2025-49984 for the vendor's fixed version and remediation status. Apply the update through the WordPress plugin manager or via WP-CLI.

Workarounds

Temporarily disable the PowerPress plugin on sites that do not require podcast functionality
Restrict outbound network access from WordPress hosts using host-based firewalls or cloud security groups, blocking traffic to internal ranges and metadata endpoints
Place the WordPress server behind an egress proxy that enforces a destination allowlist

bash

# Update PowerPress via WP-CLI once a patched release is available
wp plugin update powerpress

# Block outbound access to cloud metadata service (Linux iptables example)
iptables -A OUTPUT -d 169.254.169.254 -m owner --uid-owner www-data -j REJECT