CVE-2025-1662: 
WordPress vulnerability analysis and mitigation

The URL Media Uploader plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability in all versions up to and including 1.0.0. The vulnerability was discovered on February 27, 2025, and is tracked as CVE-2025-1662. The issue exists in the 'url_media_uploader_url_upload' action functionality of the plugin (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 6.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. The issue is classified as CWE-918 (Server-Side Request Forgery). The vulnerability requires authenticated access with author-level privileges or higher to exploit (NVD, Wordfence).

When exploited, this vulnerability allows authenticated attackers with author-level access or higher to make web requests to arbitrary locations originating from the web application. This can be leveraged to query and modify information from internal services, potentially exposing sensitive internal resources (NVD).

The vulnerability has been patched in version 1.0.1 of the URL Media Uploader plugin, which includes advanced validation for downloadable URLs to prevent Server-Side Request Forgery. Users are advised to update to this version immediately (WordPress Plugin).