CVE-2025-12962

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12962", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-10T16:58:29.926Z", "datePublished": "2025-11-18T08:27:32.912Z", "dateUpdated": "2026-04-08T17:01:42.996Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:42.996Z"}, "affected": [{"vendor": "willbontrager", "product": "Local Syndication", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.5a", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in the `[syndicate_local]` shortcode. This is due to the use of `wp_remote_get()` instead of `wp_safe_remote_get()` which lacks protections against requests to internal/private IP addresses and localhost. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal networks, and access resources that should not be accessible from external networks."}], "title": "Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7774cdfd-622a-4608-9efd-273923a0d0aa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L64"}, {"url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L41"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "timeline": [{"time": "2025-11-17T20:14:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T14:48:27.969275Z", "id": "CVE-2025-12962", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T14:48:42.850Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12962", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T14:48:27.969275Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T14:48:31.470Z"}}], "cna": {"title": "Local Syndication <= 1.5a - Authenticated (Contributor+) Server-Side Request Forgery via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Ivan Cese"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "willbontrager", "product": "Local Syndication", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.5a"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T20:14:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7774cdfd-622a-4608-9efd-273923a0d0aa?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L64"}, {"url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L41"}], "descriptions": [{"lang": "en", "value": "The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in the `[syndicate_local]` shortcode. This is due to the use of `wp_remote_get()` instead of `wp_safe_remote_get()` which lacks protections against requests to internal/private IP addresses and localhost. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal networks, and access resources that should not be accessible from external networks."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:01:42.996Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12962", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:01:42.996Z", "dateReserved": "2025-11-10T16:58:29.926Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T08:27:32.912Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Local Syndication", "vendor": "willbontrager", "versions": [{"lessThanOrEqual": "1.5a", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Local Syndication plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.5a via the `url` parameter in the `[syndicate_local]` shortcode. This is due to the use of `wp_remote_get()` instead of `wp_safe_remote_get()` which lacks protections against requests to internal/private IP addresses and localhost. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application, which can be used to query and modify information from internal services, scan internal networks, and access resources that should not be accessible from external networks."}, {"lang": "es", "value": "El plugin Local Syndication para WordPress es vulnerable a la Server-Side Request Forgery en todas las versiones hasta la 1.5a, inclusive, a trav\u00e9s del par\u00e1metro 'url' en el shortcode '[syndicate_local]'. Esto se debe al uso de 'wp_remote_get()' en lugar de 'wp_safe_remote_get()', que carece de protecciones contra peticiones a direcciones IP internas/privadas y localhost. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web, lo que puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos, escanear redes internas y acceder a recursos que no deber\u00edan ser accesibles desde redes externas."}], "id": "CVE-2025-12962", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12962", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T14:48:27.969275Z", "version": "2.0.3"}}]}, "published": "2025-11-18T09:15:49.850", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L41"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/local-syndication/tags/1.5/local_syndication.php#L64"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7774cdfd-622a-4608-9efd-273923a0d0aa?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:18:17.097601+00:00", "value": {"mitigation_remediation": ["Update Local Syndication to the latest available release that removes the insecure wp_remote_get() call, or apply the vendor\u2019s patch if one is released.", "If an upgrade is not immediately possible, delete or disable the [syndicate_local] shortcode from content and templates so no URLs are passed in user\u2011supplied content.", "Restrict the ability of Contributor users to add or edit posts that could include the shortcode; consider limiting the role to editors or administrators if possible.", "Configure network\u2013level egress filtering or firewall rules to block outbound HTTP requests from the WordPress server to internal IP ranges that are not required for legitimate site operation.", "Validate all user\u2011supplied URL inputs on the server side before making external requests, ensuring only HTTPS and whitelist\u2011allowed domains are accessed."], "summary": {"action": "Upgrade Plugin", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "WordPress sites running the willbontrager Local Syndication plugin, versions 1.5a and earlier, are affected. The vulnerability applies regardless of the specific WordPress core version, provided the plugin is installed and the user has Contributor or higher access rights.", "description_and_impact": "The Local Syndication plugin allows any authenticated user with Contributor level or higher to insert the [syndicate_local] shortcode with a custom url parameter. The plugin calls wp_remote_get() instead of the safer wp_safe_remote_get(), meaning the request is not filtered against internal or private IP ranges. This flaw permits an attacker to trigger outbound HTTP requests from the WordPress server to arbitrary internal or external hosts. The attacker can consequently read sensitive data from internal services, modify internal state, or use the server as a pivot to scan the internal network, thereby compromising confidentiality, integrity, and potentially availability of networked resources.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a medium severity vulnerability. The EPSS score of less than 1 implies that, at the time of this assessment, exploitation is very unlikely to occur. The vulnerability is not listed in the CISA KEV catalog. It is likely that exploitation would require an authenticated user with Contributor privileges, so the attack vector is limited to internal accounts. Once authenticated, the attacker can supply arbitrary URLs to the shortcode, enabling SSRF without needing to bypass any additional firewall rules beyond what meets local policy."}}}}, "created": "2025-11-18T14:15:54.656180+00:00", "updated": "2026-04-21T18:30:27.578380+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}