CVE-2025-9975: WP Scraper WordPress Plugin SSRF Vulnerability

CVE-2025-9975 Overview

CVE-2025-9975 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WP Scraper plugin for WordPress in all versions up to and including 5.8.1. The flaw resides in the wp_scraper_extract_content function, which fails to validate user-supplied URLs before issuing outbound HTTP requests. Authenticated attackers with Administrator-level privileges can abuse the function to make the WordPress server send requests to arbitrary internal or external destinations. On cloud-hosted instances, attackers can target cloud metadata endpoints to retrieve instance credentials and configuration data. The vulnerability is tracked under [CWE-918: Server-Side Request Forgery].

Critical Impact
Authenticated administrators can pivot WordPress into internal network reconnaissance and extract cloud instance metadata, including temporary IAM credentials on AWS, Azure, and GCP deployments.

Affected Products

WP Scraper plugin for WordPress, all versions up to and including 5.8.1
WordPress sites with the vulnerable plugin active
Cloud-hosted WordPress instances exposing metadata endpoints (AWS IMDSv1, Azure IMDS, GCP metadata)

Discovery Timeline

2025-10-11 - CVE-2025-9975 published to the National Vulnerability Database (NVD)
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-9975

Vulnerability Analysis

The WP Scraper plugin provides content extraction functionality that fetches remote web pages and parses their contents. The wp_scraper_extract_content function accepts a URL parameter and performs an outbound HTTP request on behalf of the WordPress server. The function does not validate the destination URL, restrict schemes, or block requests to private IP ranges and loopback addresses.

An authenticated administrator can supply arbitrary URLs, including http://127.0.0.1, http://169.254.169.254, or internal RFC1918 addresses. The plugin returns the HTTP response body to the attacker, converting the WordPress host into a proxy for internal reconnaissance. On cloud instances, requests to the metadata service can disclose instance roles, user data, and short-lived IAM credentials.

While exploitation requires Administrator privileges, the vulnerability becomes a reliable post-compromise pivot in environments where administrator accounts are shared, phished, or chained from a lower-privilege flaw. The scope change in the CVSS vector reflects impact on backend systems beyond the WordPress security boundary.

Root Cause

The root cause is missing URL validation inside the wp_scraper_extract_content function at line 688 of wp-scraper.php in version 5.8.1. The function treats administrator-submitted URLs as trusted and does not enforce an allowlist of hosts, block internal address ranges, or restrict HTTP schemes.

Attack Vector

Exploitation requires an authenticated session with Administrator-level privileges. The attacker invokes the scraper feature through the plugin's administrative interface and supplies a target URL pointing at an internal service or cloud metadata endpoint. The plugin issues the server-side request and returns the response content to the attacker's browser. See the WordPress Plugin Code Review and the Wordfence Vulnerability Report for the technical breakdown.

Detection Methods for CVE-2025-9975

Indicators of Compromise

Outbound HTTP requests from the WordPress PHP process to 169.254.169.254, metadata.google.internal, or 100.100.100.200
Access log entries showing admin-ajax.php or plugin endpoints invoking wp_scraper_extract_content with URLs targeting internal address space
Unexpected outbound connections from the web server to RFC1918 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or loopback
Cloud audit logs showing API calls authenticated with instance metadata credentials from unusual source IPs

Detection Strategies

Monitor web server and PHP-FPM egress traffic for connections to cloud metadata IPs and private network ranges
Alert on WordPress admin requests invoking the WP Scraper plugin with non-public destination hostnames
Correlate successful WordPress administrator logins with subsequent anomalous outbound HTTP activity from the host
Review installed WordPress plugins and flag any instance of WP Scraper at version 5.8.1 or earlier

Monitoring Recommendations

Enforce Instance Metadata Service Version 2 (IMDSv2) with hop limit of 1 on AWS to prevent SSRF-based credential theft
Enable VPC flow logs and alert on web-tier hosts initiating connections to metadata endpoints
Ingest WordPress audit logs and web server access logs into a centralized SIEM for correlation across authentication and egress activity
Track plugin installation and version changes across the WordPress fleet to identify vulnerable deployments

How to Mitigate CVE-2025-9975

Immediate Actions Required

Update the WP Scraper plugin to a version newer than 5.8.1 once the vendor publishes a fix referenced in the WordPress Plugin Change Log
Deactivate WP Scraper if a patched release is unavailable and the plugin is not business-critical
Audit WordPress administrator accounts, enforce multi-factor authentication, and remove unused admin users
Rotate any cloud IAM credentials tied to instance roles if exploitation is suspected

Patch Information

Refer to the WordPress Plugin Change Log and the Wordfence Vulnerability Report for the vendor-provided fix once released. Apply the update across all WordPress instances running WP Scraper.

Workarounds

Restrict outbound traffic from the WordPress server using host firewall rules or security groups that block access to 169.254.169.254 and private network ranges
Enforce IMDSv2 on AWS EC2 instances and set the metadata hop limit to 1 to defeat proxied SSRF requests
Place a forward proxy or web application firewall between WordPress and the internet with an outbound allowlist of required third-party domains
Limit Administrator role assignment to a minimal set of accounts and require strong authentication for all administrative access

bash

# AWS CLI: enforce IMDSv2 and restrict metadata hop limit on the WordPress EC2 instance
aws ec2 modify-instance-metadata-options \
    --instance-id i-0123456789abcdef0 \
    --http-tokens required \
    --http-put-response-hop-limit 1 \
    --http-endpoint enabled