CVE-2025-5818: 
WordPress vulnerability analysis and mitigation

CVE-2025-5818 is a Server-Side Request Forgery (SSRF) vulnerability in the "Featured Image Plus – Quick & Bulk Edit with Unsplash" plugin for WordPress. It affects all versions up to and including 1.6.6 via the fip_get_image_options() function, allowing authenticated attackers with administrator-level access to make arbitrary web requests from the server. The vulnerability was published on July 23, 2025, and carries a CVSS v3.1 base score of 5.5 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and originates in the fip_get_image_options() function within the plugin's block editor actions file (inc/admin/block-editor/block-editor-actions.php, line 166). An authenticated administrator can supply a crafted URL parameter that causes the server to issue HTTP requests to arbitrary internal or external locations, potentially reaching services not otherwise accessible from the internet. The attack vector is network-based, requires no user interaction, and has a changed scope, meaning the SSRF can affect resources beyond the vulnerable component itself (Wordfence, WordPress Trac).

Successful exploitation allows an attacker to query and potentially modify information from internal services accessible to the web server, such as cloud metadata endpoints (e.g., AWS IMDSv1), internal APIs, or other backend services. The confidentiality and integrity impacts are both rated Low, with no direct availability impact; however, access to internal service metadata could facilitate privilege escalation or lateral movement within cloud-hosted environments. The scope change means the impact extends beyond the WordPress application itself to other networked resources (Wordfence, Red Hat CVE).

Exploitation requires administrator-level authentication, which significantly limits the attack surface. No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported. The EPSS score is approximately 0.023% (0.000230), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Authentication: Log in to the WordPress admin panel with an account holding administrator-level privileges or higher.
2. Identify the vulnerable function: Navigate to a page or post using the block editor where the Featured Image Plus plugin is active, triggering calls to fip_get_image_options().
3. Craft a malicious request: Intercept the HTTP request made by the plugin (e.g., using Burp Suite) and modify the URL parameter passed to fip_get_image_options() to point to an internal resource, such as http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or an internal service IP.
4. Retrieve response: The server fetches the specified URL and may return the response content to the attacker, exposing internal service data such as cloud credentials, internal API responses, or network topology information (Wordfence, WordPress Trac).

• Network: Outbound HTTP requests from the WordPress server to internal IP ranges (e.g., 169.254.169.254, 10.x.x.x, 172.16.x.x, 192.168.x.x) or unexpected external hosts, originating from the web server process.
• Logs: Web server or application logs showing requests to the plugin's AJAX or REST endpoints with unusual or internal URL values in parameters associated with fip_get_image_options().
• Process: The PHP/web server process initiating outbound connections to non-standard destinations, particularly cloud metadata services or internal network addresses.

Users should update the Featured Image Plus – Quick & Bulk Edit with Unsplash plugin to a version beyond 1.6.6 once a patched release is available from the plugin vendor (krasenslavov). In the interim, administrators should consider deactivating the plugin if it is not essential, or restricting admin panel access to trusted IP addresses only. Enforcing the principle of least privilege and monitoring outbound network connections from the web server can reduce risk (Wordfence, Wordfence Weekly Report).

Wordfence disclosed and reported this vulnerability as part of their weekly WordPress vulnerability intelligence report for July 21–27, 2025, noting it as a Medium severity issue requiring administrator access (Wordfence Weekly Report). Red Hat also tracked the CVE in their security advisory database (Red Hat CVE). No significant broader media coverage or notable researcher commentary beyond standard vulnerability aggregation has been observed.