CVE-2025-5818: WordPress Featured Image Plus SSRF Vulnerability

CVE-2025-5818 Overview

CVE-2025-5818 is a Server-Side Request Forgery (SSRF) vulnerability in the Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress. The flaw affects all versions up to and including 1.6.6 and resides in the fip_get_image_options() function. Authenticated attackers with administrator-level access or above can issue web requests from the vulnerable WordPress server to arbitrary destinations. This capability enables adversaries to probe internal network services, query cloud metadata endpoints, and potentially modify data on internal systems that trust the WordPress host. The vulnerability is classified under [CWE-918] (Server-Side Request Forgery).

Critical Impact
Authenticated administrators can pivot from the WordPress host into internal networks, reaching services that are otherwise inaccessible from the public internet.

Affected Products

Featured Image Plus – Quick & Bulk Edit with Unsplash plugin for WordPress
All versions up to and including 1.6.6
WordPress installations exposing the plugin's block editor actions

Discovery Timeline

2025-07-23 - CVE-2025-5818 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-5818

Vulnerability Analysis

The Featured Image Plus plugin exposes the fip_get_image_options() function within its block editor actions handler. This function accepts a user-supplied URL and performs a server-side HTTP request to retrieve image metadata. The plugin does not validate or restrict the destination of that request, allowing arbitrary URLs to be substituted.

Because the request originates from the WordPress server, it inherits network reachability that external attackers do not have. This includes internal RFC1918 address space, loopback services, and cloud instance metadata endpoints such as 169.254.169.254. The response content can be surfaced back to the requesting administrator or used to enumerate internal infrastructure through timing and error signals.

Exploitation requires administrator-level authentication, which raises the bar but does not eliminate the risk. Compromised administrator sessions, insider misuse, and multi-tenant WordPress environments where lower-privileged customers hold admin rights on their own sites all represent realistic exploitation scenarios.

Root Cause

The root cause is missing URL validation and destination filtering inside fip_get_image_options(). The function trusts the caller-supplied URL and forwards it to the HTTP client without enforcing an allowlist of image hosts, blocking private address ranges, or rejecting non-HTTP schemes. See the WordPress Plugin Code Reference for the affected code path.

Attack Vector

An authenticated administrator invokes the plugin's block editor AJAX action and supplies a crafted URL targeting an internal resource. The WordPress server issues the request server-side and returns the response, disclosing information about internal services or triggering state-changing operations on unauthenticated internal APIs. Refer to the Wordfence Vulnerability Report for additional advisory details.

Detection Methods for CVE-2025-5818

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback addresses
Requests from the WordPress host to cloud metadata endpoints such as 169.254.169.254
Unexpected invocations of Featured Image Plus block editor AJAX actions targeting non-image URLs
Web server access logs showing administrator sessions triggering fip_get_image_options() with unusual URL parameters

Detection Strategies

Inspect WordPress plugin inventory for featured-image-plus versions at or below 1.6.6
Correlate administrator authentication events with outbound network flows from the WordPress server to non-image CDN destinations
Deploy web application firewall rules that inspect the URL parameter passed to the plugin's block editor endpoints

Monitoring Recommendations

Log and alert on egress traffic from web application servers to private IP ranges and metadata services
Enable WordPress audit logging to capture administrator actions invoking plugin AJAX endpoints
Monitor for anomalous PHP wp_remote_get or curl outbound patterns tied to the plugin process

How to Mitigate CVE-2025-5818

Immediate Actions Required

Update the Featured Image Plus plugin to a version above 1.6.6 as soon as a patched release is available
Audit all administrator accounts on affected WordPress sites and remove unused or stale privileges
Restrict egress traffic from WordPress hosts to only the external image services required by the plugin
Block WordPress server access to cloud instance metadata endpoints at the network or IMDSv2 enforcement layer

Patch Information

Review the WordPress Plugin Changeset for the vendor code changes associated with this issue and confirm the deployed plugin version incorporates the fix. Consult the Wordfence Vulnerability Report for the latest fixed-version guidance.

Workarounds

Deactivate and remove the Featured Image Plus plugin until an updated version is installed
Enforce IMDSv2 with session tokens on AWS-hosted WordPress instances to neutralize metadata-based SSRF
Place the WordPress host behind an egress proxy that allowlists known image CDN domains
Reduce the number of accounts holding the administrator role to limit the exploitable population

bash

# Example egress restriction using iptables to block private ranges from the WordPress user
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT