CVE-2025-60175 Overview
CVE-2025-60175 is a Server-Side Request Forgery (SSRF) vulnerability affecting the PopAd WordPress plugin in versions up to and including 1.0.4. The flaw [CWE-918] allows an authenticated administrator to coerce the WordPress server into issuing arbitrary outbound HTTP requests on the attacker's behalf. Because the request originates from the server, attackers can reach internal endpoints, cloud metadata services, or other systems that are otherwise unreachable from the public internet.
Critical Impact
An attacker holding administrator credentials can pivot the WordPress host into internal networks and exfiltrate limited data through forged server-side requests.
Affected Products
- PopAd WordPress plugin versions <= 1.0.4
- WordPress installations with the vulnerable plugin enabled
- Hosting environments where the WordPress server can reach internal-only services
Discovery Timeline
- 2026-06-15 - CVE-2025-60175 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60175
Vulnerability Analysis
The PopAd plugin exposes an administrator-accessible function that accepts a URL parameter and performs a server-side fetch without enforcing strict URL validation. The plugin does not restrict the destination scheme, host, or IP range before initiating the outbound request. As a result, an authenticated administrator can supply URLs targeting localhost, private network ranges such as 10.0.0.0/8 and 192.168.0.0/16, or cloud metadata endpoints like 169.254.169.254.
The attack requires high privileges and elevated complexity, which limits practical exploitation. However, the scope is changed because the server, not the attacker, performs the request, allowing the attacker to bypass network boundaries enforced outside the WordPress application. EPSS data places the likelihood of exploitation in the low single digits, consistent with the privileged precondition.
Root Cause
The root cause is missing input validation on URL parameters consumed by an HTTP client routine within the plugin. The code accepts attacker-controlled destinations without applying allowlists, DNS resolution checks, or filtering of private and link-local address ranges, matching the pattern described in [CWE-918].
Attack Vector
The attack vector is network-based and requires administrator authentication. The attacker submits a crafted request to the vulnerable plugin endpoint with a URL pointing to an internal resource. The WordPress host issues the request and may return response data, headers, or timing information to the attacker. See the Patchstack WordPress SSRF Vulnerability advisory for technical details.
Detection Methods for CVE-2025-60175
Indicators of Compromise
- Outbound HTTP requests from the WordPress PHP worker to private IP ranges or 169.254.169.254
- Administrator-authenticated POST requests to PopAd plugin endpoints containing URL parameters with unusual hosts
- Web server access logs showing repeated administrator activity targeting the plugin's request-handling routes
Detection Strategies
- Inspect PHP and web server logs for wp-admin requests to PopAd handlers carrying URL parameters pointing to internal or metadata addresses
- Correlate WordPress administrator session activity with anomalous egress traffic from the web host
- Deploy a web application firewall rule that flags administrator POSTs to the plugin containing private RFC1918 hosts or file://, gopher://, or dict:// schemes
Monitoring Recommendations
- Enable egress logging on the WordPress host and alert on connections to cloud metadata IPs and internal management interfaces
- Track administrator account logins and forward authentication events to a centralized log platform for review
- Audit installed plugin versions on a recurring schedule and alert when PopAd <= 1.0.4 is detected
How to Mitigate CVE-2025-60175
Immediate Actions Required
- Identify WordPress sites running PopAd and confirm the installed version against 1.0.4
- Disable or uninstall the PopAd plugin until a patched release is available and validated
- Rotate WordPress administrator credentials and review recent administrator activity for suspicious URL submissions
Patch Information
No fixed version is listed in the available advisory at publication time. Monitor the Patchstack WordPress SSRF Vulnerability entry and the plugin's WordPress.org page for an updated release beyond 1.0.4.
Workarounds
- Restrict the WordPress host's outbound network access using firewall egress rules that deny traffic to internal networks and cloud metadata endpoints
- Place the WordPress administrative interface behind an IP allowlist or VPN to reduce the number of accounts able to reach the vulnerable endpoint
- Apply a virtual patch through a web application firewall that blocks URL parameters resolving to private address ranges
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
