CVE-2025-13999: 
WordPress vulnerability analysis and mitigation

CVE-2025-13999 is a Server-Side Request Forgery (SSRF) vulnerability in the HTML5 Audio Player – The Ultimate No-Code Podcast, MP3 & Audio Player WordPress plugin by bPlugins. It affects all versions from 2.4.0 up to and including 2.5.1, and was disclosed on December 19, 2025. The flaw allows unauthenticated attackers to make arbitrary web requests from the server, potentially reaching internal services. It carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and resides in the getIcyMetadata() function within the plugin's Ajax.php file. Because this AJAX handler does not require authentication and fails to validate or restrict user-supplied URLs, an unauthenticated attacker can supply an arbitrary URL that the server will fetch on their behalf. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, enabling interaction with internal network resources not directly accessible to the attacker. A patch diff is publicly available in the WordPress plugin repository changeset (WordPress Changeset).

Successful exploitation allows an unauthenticated attacker to pivot the WordPress server into a proxy for reaching internal services, cloud metadata endpoints (e.g., AWS IMDSv1 at 169.254.169.254), or other hosts on the internal network. This results in low-level confidentiality impact (e.g., reading internal service responses or cloud credentials) and low-level integrity impact (e.g., triggering state-changing requests to internal APIs). Availability is not directly impacted, but lateral movement and credential harvesting from cloud metadata services could lead to broader compromise (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the time of disclosure. The vulnerability requires no authentication and no user interaction, making it trivially exploitable against any unpatched installation. The EPSS score is approximately 0.052%, indicating a currently low probability of exploitation in the near term. It has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Reconnaissance: Identify WordPress sites running the HTML5 Audio Player plugin (versions 2.4.0–2.5.1) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:/wp-content/plugins/html5-audio-player).
2. Locate the vulnerable AJAX endpoint: The getIcyMetadata() function is exposed via WordPress's AJAX mechanism, typically accessible at /wp-admin/admin-ajax.php with the appropriate action parameter, and does not require authentication (available to unauthenticated users via wp_ajax_nopriv_).
3. Craft the SSRF request: Send an HTTP POST request to the AJAX endpoint with a crafted url parameter pointing to an internal target, such as http://169.254.169.254/latest/meta-data/ (AWS metadata) or an internal service like http://192.168.1.1/.
4. Retrieve the response: The server fetches the specified URL and returns the response to the attacker, potentially exposing cloud credentials, internal service data, or network topology information.
5. Pivot or escalate: Use harvested credentials or internal service information to escalate privileges or move laterally within the hosting environment (Wordfence, WordPress Changeset).

• Network: Outbound HTTP/HTTPS requests from the WordPress server to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254); unusual outbound connections to unexpected external hosts initiated by the web server process.
• Logs: WordPress/web server access logs showing POST requests to /wp-admin/admin-ajax.php with SSRF-related action parameters and internal or metadata URLs as parameter values; repeated requests from a single IP to the AJAX endpoint with varying url parameters.
• Process: Web server process (e.g., apache2, nginx, php-fpm) initiating unexpected outbound network connections to internal network addresses.

Update the HTML5 Audio Player plugin to version 2.5.2 or later, which patches the getIcyMetadata() function to restrict arbitrary URL fetching (WordPress Changeset). As a temporary workaround if immediate patching is not possible, use a Web Application Firewall (WAF) rule to block requests to the vulnerable AJAX action, or restrict outbound HTTP requests from the web server using firewall egress rules to prevent SSRF pivoting to internal resources. Disabling the plugin entirely until patching is feasible is also a viable interim measure.

Wordfence reported the vulnerability as part of their weekly WordPress vulnerability report covering December 15, 2025 to January 4, 2026, noting it as a High severity SSRF issue (Wordfence Blog). RedPacketSecurity shared the disclosure on Mastodon, and the vulnerability was picked up by several aggregators including VulDB, Vulners, and ENISA's EUVD. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregation.