CVE-2025-7843: WordPress Auto Save Remote Images SSRF Flaw

CVE-2025-7843 Overview

CVE-2025-7843 is a Server-Side Request Forgery (SSRF) vulnerability in the Auto Save Remote Images (Drafts) plugin for WordPress. The flaw affects all plugin versions up to and including 1.0.9. The issue resides in the fetch_images() function, which fails to validate destination URLs before issuing outbound requests.

Authenticated attackers with Contributor-level access or higher can abuse the flaw to send crafted web requests from the WordPress server to arbitrary destinations. This allows adversaries to reach internal services, cloud metadata endpoints, and other resources that are normally unreachable from the public internet [CWE-918].

Critical Impact
Authenticated contributors can coerce the WordPress server into making arbitrary HTTP requests to internal infrastructure, enabling reconnaissance and interaction with non-public services.

Affected Products

Auto Save Remote Images (Drafts) WordPress plugin versions 1.0.9 and earlier
WordPress installations with the plugin active and Contributor accounts provisioned
Hosting environments exposing internal services or cloud metadata to the WordPress host

Discovery Timeline

2025-09-10 - CVE-2025-7843 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-7843

Vulnerability Analysis

The vulnerability is classified as Server-Side Request Forgery under [CWE-918]. The plugin's fetch_images() function accepts image URLs supplied by authenticated users and retrieves the content server-side. The function does not restrict target hosts, schemes, or IP ranges before performing the request.

An attacker with Contributor privileges can supply URLs pointing to internal-only endpoints. The WordPress server dutifully issues the request and, depending on response handling, may return content or side effects visible to the attacker. This turns the WordPress host into a proxy for internal reconnaissance and interaction.

The attack requires network access to the WordPress admin interface and a valid low-privilege account. No user interaction from an administrator is needed once the attacker is authenticated. Contributor accounts are common on multi-author blogs and self-registration sites, lowering the barrier to exploitation.

Root Cause

The root cause is missing URL validation in the fetch_images() function. The plugin trusts user-supplied image URLs and does not enforce an allowlist of remote hosts, block private IP ranges (RFC 1918, loopback, link-local), or restrict URL schemes to http and https against public destinations only.

Attack Vector

Exploitation occurs over the network against the WordPress REST or admin endpoint that triggers fetch_images(). An authenticated Contributor submits a draft or triggers the fetch workflow with a crafted URL such as one pointing at http://127.0.0.1, an internal service IP, or a cloud provider metadata endpoint like http://169.254.169.254/. The plugin then issues the outbound HTTP request from the server context.

Refer to the Wordfence Vulnerability Report for additional technical detail on the affected function and exploitation preconditions.

Detection Methods for CVE-2025-7843

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal RFC 1918 addresses, 127.0.0.1, or 169.254.169.254
Web server access logs showing Contributor-level users invoking the plugin's image fetch endpoints with unusual URL parameters
Unexpected entries in the WordPress media library or draft posts referencing internal hostnames

Detection Strategies

Inspect PHP-FPM or web server egress traffic for connections originating from the WordPress process to non-public destinations
Correlate authenticated Contributor session activity with outbound HTTP requests initiated by the plugin
Review plugin request payloads for URLs containing private IP ranges, alternate schemes (file://, gopher://), or cloud metadata hostnames

Monitoring Recommendations

Enable WordPress audit logging for post creation and plugin-invoked HTTP requests
Forward web server access logs and egress firewall logs to a centralized analytics platform for correlation
Alert on any request from the WordPress host to the cloud instance metadata service

How to Mitigate CVE-2025-7843

Immediate Actions Required

Deactivate the Auto Save Remote Images (Drafts) plugin until a patched version is verified and installed
Audit Contributor and higher-privilege accounts and remove unused or untrusted users
Block outbound requests from the WordPress host to internal networks and cloud metadata endpoints at the network layer

Patch Information

No patched version is identified in the referenced advisories at the time of publication. Monitor the WordPress plugin page and the Wordfence advisory for a release beyond version 1.0.9 that addresses the SSRF flaw in fetch_images().

Workarounds

Restrict egress from the WordPress server to an allowlist of known remote image hosts
Enforce IMDSv2 with hop-limit restrictions on cloud instances to reduce metadata exposure
Require administrator approval for new Contributor registrations and disable open self-registration
Deploy a web application firewall rule blocking image URL parameters that reference private IP ranges or non-HTTP schemes

bash

# Example egress restriction using iptables to block WordPress host access to metadata IP
iptables -A OUTPUT -m owner --uid-owner www-data -d 169.254.169.254 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 127.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 10.0.0.0/8 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 172.16.0.0/12 -j REJECT
iptables -A OUTPUT -m owner --uid-owner www-data -d 192.168.0.0/16 -j REJECT