CVE-2025-60181: Silencesoft RSS Reader SSRF Vulnerability

CVE-2025-60181 Overview

CVE-2025-60181 is a Server-Side Request Forgery (SSRF) vulnerability affecting the Silencesoft RSS Reader WordPress plugin (external-rss-reader). The flaw exists in all versions up to and including 0.6. An unauthenticated attacker can coerce the plugin to issue HTTP requests to attacker-controlled or internal destinations. This can expose internal services, metadata endpoints, or resources behind the network perimeter. The vulnerability is classified under CWE-918: Server-Side Request Forgery.

Critical Impact
An unauthenticated attacker can abuse the plugin to send arbitrary server-side HTTP requests, potentially reaching internal networks, cloud metadata services, or otherwise restricted endpoints.

Affected Products

Silencesoft RSS Reader WordPress plugin (external-rss-reader)
All versions from initial release through 0.6
WordPress sites with the plugin installed and enabled

Discovery Timeline

2025-09-26 - CVE-2025-60181 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60181

Vulnerability Analysis

The Silencesoft RSS Reader plugin fetches remote RSS feeds on behalf of the WordPress server. The plugin does not sufficiently validate or restrict the URL destinations it retrieves. An attacker can supply a crafted URL that the server processes as if it were a legitimate feed source. The server then issues an outbound request to the attacker-specified target from within the trusted network boundary.

SSRF flaws in feed-reader components are well-documented and typically arise when user-supplied URLs are passed directly to HTTP client functions without allowlisting schemes, hosts, or IP ranges. The attack requires network access to the WordPress site but no authentication or user interaction.

Root Cause

The root cause is missing validation of user-controlled URLs before invoking the plugin's server-side HTTP fetch routine. The plugin trusts the supplied feed URL and does not enforce restrictions against internal IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254), non-HTTP schemes, or redirect chains that resolve to private hosts.

Attack Vector

The attack vector is network-based and does not require credentials. An attacker submits a crafted feed URL to a vulnerable plugin endpoint. The WordPress server dereferences the URL and returns or processes the response. Attackers commonly target cloud instance metadata services, internal admin panels, or reachable databases. Successful exploitation can disclose limited information and enable pivoting inside the network perimeter.

No verified public proof-of-concept code is available at the time of writing. Refer to the Patchstack WordPress Plugin Advisory for additional technical context.

Detection Methods for CVE-2025-60181

Indicators of Compromise

Outbound HTTP requests from the WordPress host to internal IP ranges or cloud metadata endpoints such as 169.254.169.254.
Access log entries showing requests to plugin endpoints (external-rss-reader) with unusual or non-RSS URL parameters.
Web server processes initiating connections to loopback addresses or non-standard ports.

Detection Strategies

Inspect WordPress access logs for requests referencing the plugin with externally supplied URL parameters.
Monitor egress traffic from web servers for connections to RFC1918 addresses and cloud metadata IPs.
Deploy web application firewall (WAF) rules that flag requests containing URL parameters pointing to private IP ranges or non-HTTP schemes.

Monitoring Recommendations

Enable centralized logging of PHP outbound HTTP calls where possible.
Alert on repeated failed or redirected fetch attempts originating from the WordPress process.
Correlate web request patterns with egress firewall telemetry to identify SSRF probing behavior.

How to Mitigate CVE-2025-60181

Immediate Actions Required

Deactivate and remove the Silencesoft RSS Reader plugin until a patched release is available.
Restrict egress traffic from the WordPress server so it cannot reach internal management networks or cloud metadata endpoints.
Review web server access logs for prior exploitation attempts against the plugin.

Patch Information

No fixed version has been published by the vendor at the time of this writing. The vulnerability affects all versions through 0.6. Consult the Patchstack WordPress Plugin Advisory for update status.

Workarounds

Uninstall the plugin and replace it with a maintained RSS aggregator that validates feed URLs.
Enforce network-level egress controls that block WordPress hosts from reaching private IP ranges and cloud metadata services.
Apply WAF rules that reject plugin requests containing URL parameters resolving to internal hosts or non-HTTP schemes.

bash

# Example egress restriction using iptables to block metadata endpoint access
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -j DROP