CVE-2025-10583: 
WordPress vulnerability analysis and mitigation

CVE-2025-10583 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Fastest Cache Premium plugin for WordPress, affecting all versions up to and including 1.7.4. The flaw exists in the get_server_time_ajax_request AJAX action and allows authenticated attackers with Subscriber-level access or higher to make arbitrary web requests originating from the web server, enabling interaction with internal services. The free version of WP Fastest Cache is not affected. It was published on December 12, 2025, with a CVSS v3.1 base score of 3.5 (Low) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization) — the get_server_time_ajax_request AJAX endpoint fails to properly restrict which URLs can be requested, allowing any authenticated subscriber-level user to supply arbitrary targets. An attacker sends a crafted AJAX request to the vulnerable endpoint with a controlled URL parameter, causing the WordPress server to issue an outbound HTTP request to an attacker-specified destination, including internal network resources. Exploitation requires network access to the WordPress site and a valid low-privilege account (Subscriber or above), but does not require user interaction. High attack complexity is noted in the CVSS vector, suggesting some conditions must be met for reliable exploitation (Wordfence, Red Hat CVE).

Successful exploitation allows an attacker to use the WordPress server as a proxy to query or interact with internal services that would otherwise be inaccessible from the internet, such as cloud metadata endpoints (e.g., AWS IMDSv1), internal APIs, or intranet resources. The integrity impact is rated Low (limited modification of internal service data), while confidentiality and availability are not directly impacted per the CVSS assessment. In environments with sensitive internal services or cloud infrastructure, SSRF can serve as a stepping stone for privilege escalation or lateral movement (Wordfence, Red Hat CVE).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported as of the available data. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.025% (0.000250), indicating a very low probability of exploitation in the near term. Exploitation requires a valid WordPress account with at least Subscriber-level privileges, which limits the attacker pool (Wordfence).

1. Reconnaissance: Identify WordPress sites running WP Fastest Cache Premium version ≤1.7.4 using tools like WPScan or by inspecting plugin metadata in publicly accessible files.
2. Obtain low-privilege credentials: Register or obtain a Subscriber-level (or higher) WordPress account on the target site.
3. Craft malicious AJAX request: Authenticate to WordPress and send a POST request to the WordPress AJAX handler (/wp-admin/admin-ajax.php) with action=get_server_time_ajax_request and a URL parameter pointing to an internal target (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata, or an internal service IP).
4. Receive server response: The WordPress server issues the forged request and may return response data, allowing the attacker to enumerate internal services, retrieve cloud instance metadata, or probe internal network topology.
5. Leverage gathered information: Use retrieved data (e.g., IAM credentials from cloud metadata) for further privilege escalation or lateral movement within the environment (Wordfence).

• Network: Outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 169.254.169.254, RFC1918 addresses) or unexpected external hosts, particularly originating from the web server process.
• Logs: WordPress access logs showing repeated POST requests to /wp-admin/admin-ajax.php with action=get_server_time_ajax_request and unusual or internal URL values in request parameters.
• Logs: Web server error logs or application logs showing connection attempts to internal services or cloud metadata endpoints.
• Process: Unusual outbound connections from the PHP-FPM or Apache/Nginx process to non-standard destinations on ports 80, 443, or other internal service ports.

Update WP Fastest Cache Premium to version 1.7.5 or later, which addresses this vulnerability. The free version of WP Fastest Cache is not affected and does not require action. As a temporary workaround, site administrators can restrict WordPress user registration to prevent untrusted users from obtaining Subscriber-level accounts, or use a web application firewall (WAF) rule to block requests to the vulnerable AJAX action from low-privilege users. Review and restrict outbound HTTP requests from the web server at the network/firewall level to limit SSRF impact (Wordfence, WP Fastest Cache Changelog).

The vulnerability was discovered and disclosed by Wordfence, which assigned it a low severity rating consistent with the limited CVSS score. No significant public commentary, media coverage, or notable researcher discussion has been identified beyond the initial advisory and standard vulnerability database entries.