CVE-2025-14613: 
WordPress vulnerability analysis and mitigation

CVE-2025-14613 is a Server-Side Request Forgery (SSRF) vulnerability in the GetContentFromURL plugin for WordPress, affecting all versions up to and including 1.0. The flaw was disclosed on January 14, 2026, and stems from the plugin's use of wp_remote_get() instead of the safer wp_safe_remote_get() function when fetching user-supplied URLs via the [gcfu] shortcode. It carries a CVSS v3.1 base score of 7.2 (High), as assigned by Wordfence (Wordfence, NVD).

The root cause is classified as CWE-918 (Server-Side Request Forgery), arising from insufficient validation of the url parameter passed to the [gcfu] shortcode in shortcode.class.php (line 20). The plugin calls wp_remote_get(), which does not restrict requests to external or safe hosts, allowing the server to be directed to make HTTP requests to arbitrary destinations — including internal network resources. Exploitation requires at minimum Contributor-level authentication on the WordPress site, meaning the attacker must have a valid account with that role or higher (Wordfence, NVD).

Successful exploitation allows an authenticated attacker to cause the WordPress server to issue HTTP requests to arbitrary internal or external locations, potentially exposing sensitive internal services such as cloud metadata endpoints (e.g., AWS IMDSv1), internal APIs, or other network-accessible resources. The vulnerability has a changed scope, meaning it can affect components beyond the WordPress application itself. Confidentiality and integrity impacts are rated low, with no direct availability impact, but the ability to probe and interact with internal services could facilitate further lateral movement or information disclosure (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14613. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at least Contributor-level access, which limits the attack surface compared to unauthenticated vulnerabilities (Wordfence, Feedly).

1. Gain Contributor Access: Obtain or register a WordPress account with at least Contributor-level privileges on the target site running the GetContentFromURL plugin version 1.0 or earlier.
2. Identify the vulnerable shortcode: Confirm the plugin is active by checking for the [gcfu] shortcode functionality in the WordPress editor.
3. Craft a malicious shortcode: Insert a post or page containing the shortcode with a crafted url parameter pointing to an internal resource, e.g., [gcfu url="http://169.254.169.254/latest/meta-data/"] to target AWS instance metadata, or [gcfu url="http://192.168.1.1/admin"] for internal network services.
4. Trigger the request: Publish or preview the post/page, causing the WordPress server to execute wp_remote_get() against the attacker-specified URL.
5. Retrieve the response: Observe the rendered page output or use additional techniques to capture the HTTP response returned from the internal service, potentially exposing credentials, tokens, or sensitive configuration data (Wordfence, NVD).

• Logs: WordPress server-side HTTP request logs showing outbound connections to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (169.254.169.254) originating from the web server process.
• Logs: WordPress access logs showing authenticated Contributor-level users creating or previewing posts containing [gcfu url= shortcodes with suspicious or internal URLs.
• Network: Unexpected outbound HTTP GET requests from the WordPress server to internal network hosts or metadata services, particularly on ports 80 or 443.
• File System: Review of post content in the WordPress database (wp_posts table) for entries containing [gcfu url="http://internal... or similar SSRF payloads.

The recommended remediation is to update the GetContentFromURL plugin to a version that replaces wp_remote_get() with wp_safe_remote_get(), which restricts requests to safe, external URLs only. As of the disclosure date, no patched version beyond 1.0 has been confirmed publicly; site administrators should check the WordPress plugin repository for updates or consider deactivating and removing the plugin until a fix is available. Additionally, restricting Contributor-level account creation and enforcing the principle of least privilege can reduce the attack surface (Wordfence, NVD).

Wordfence identified and reported the vulnerability, publishing it to their threat intelligence platform on January 14, 2026. The CISA Vulnerability Bulletin for the week of January 12, 2026 included this CVE in its weekly summary. RedPacket Security also flagged the vulnerability via social media and their alerting service. No significant broader media coverage or notable researcher commentary beyond standard vulnerability tracking has been observed (Wordfence, CISA).