Overview
A Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2025-12800, has been discovered in the WP Shortcodes Plugin (Shortcodes Ultimate) for WordPress. This flaw affects all versions up to and including 7.4.5. Authenticated attackers with Administrator-level access (and potentially Contributor+ access under specific configurations) can exploit this vulnerability to make arbitrary web requests originating from the WordPress server. This could lead to the exposure of sensitive internal information and modification of internal services.
Technical Details
The vulnerability resides within the su_shortcode_csv_table function. This function allows users to import CSV data, and the vulnerable code allows the attacker to specify the URL from which the CSV data should be fetched. Due to insufficient validation of the provided URL, an attacker can supply an internal address (e.g., http://localhost/) or an address within the internal network. The server then unwittingly fetches data from the attacker-specified location.
If the ‘Unsafe features’ option in the Shortcodes Ultimate plugin is explicitly enabled by an administrator, the vulnerability is also exploitable by users with Contributor or higher roles. This is due to the elevated privileges granted when this option is activated.
Example Exploitation Scenario (Administrator Account Required):
[su_csv_table url="http://internal-service/sensitive-data"]
CVSS Analysis
- CVE ID: CVE-2025-12800
- Severity: MEDIUM
- CVSS Score: 6.4
This CVSS score indicates a medium severity vulnerability. While the exploit requires authentication with a relatively high privilege level (Administrator by default), the potential impact on internal systems justifies a prompt response.
Possible Impact
Successful exploitation of this SSRF vulnerability could lead to:
- Information Disclosure: Exposure of sensitive data residing on internal services (e.g., databases, internal APIs).
- Internal Network Scanning: An attacker could probe the internal network to identify other vulnerable services.
- Denial of Service (DoS): Overloading internal services with requests.
- Potential for Remote Code Execution (RCE): In certain circumstances, SSRF can be chained with other vulnerabilities to achieve remote code execution on internal systems.
Mitigation and Patch Steps
- Immediate Update: The most critical step is to update the WP Shortcodes Plugin (Shortcodes Ultimate) to the latest version. The vulnerability has been addressed in a subsequent release (version > 7.4.5).
- Disable ‘Unsafe Features’: If you have enabled the ‘Unsafe features’ option within the Shortcodes Ultimate plugin settings, strongly consider disabling it unless absolutely necessary. This reduces the attack surface considerably.
- Monitor Logs: Regularly monitor your WordPress server logs for suspicious activity, particularly requests originating from the WordPress server to unusual destinations.
- Web Application Firewall (WAF): Consider implementing a Web Application Firewall (WAF) with rules to detect and block SSRF attempts.
