CVE-2025-67961

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-67961", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-12-15T10:00:23.851Z", "datePublished": "2026-01-22T16:51:57.784Z", "dateUpdated": "2026-04-28T19:29:26.112Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wpo365-login", "product": "WPO365", "vendor": "Marco van Wieren", "versions": [{"changes": [{"at": "40.1", "status": "unaffected"}], "lessThanOrEqual": "40.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:02:21.423Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.<p>This issue affects WPO365: from n/a through <= 40.0.</p>"}], "value": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:24.988Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/wpo365-login/vulnerability/wordpress-wpo365-plugin-40-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "title": "WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-01-29T00:11:18.100778Z", "id": "CVE-2025-67961", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T19:29:26.112Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-67961", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-29T00:11:18.100778Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-01-29T00:11:12.286Z"}}], "cna": {"title": "WordPress WPO365 plugin <= 40.0 - Server Side Request Forgery (SSRF) vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Phat RiO | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 6.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Marco van Wieren", "product": "WPO365", "versions": [{"status": "affected", "changes": [{"at": "40.1", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "40.0"}], "packageName": "wpo365-login", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:02:21.423Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/wpo365-login/vulnerability/wordpress-wpo365-plugin-40-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0.", "supportingMedia": [{"type": "text/html", "value": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.<p>This issue affects WPO365: from n/a through <= 40.0.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:24.988Z"}}}, "cveMetadata": {"cveId": "CVE-2025-67961", "state": "PUBLISHED", "dateUpdated": "2026-04-28T19:29:26.112Z", "dateReserved": "2025-12-15T10:00:23.851Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-01-22T16:51:57.784Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wpo365-login", "product": "WPO365", "vendor": "Marco van Wieren", "versions": [{"changes": [{"at": "40.1", "status": "unaffected"}], "lessThanOrEqual": "40.0", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "audit@patchstack.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Marco van Wieren WPO365 wpo365-login allows Server Side Request Forgery.This issue affects WPO365: from n/a through <= 40.0."}, {"lang": "es", "value": "Vulnerabilidad de falsificaci\u00f3n de petici\u00f3n del lado del servidor (SSRF) en Marco van Wieren WPO365 wpo365-login permite la falsificaci\u00f3n de petici\u00f3n del lado del servidor. Este problema afecta a WPO365: desde n/a hasta &lt;= 40.0."}], "id": "CVE-2025-67961", "lastModified": "2026-06-17T09:58:20.220", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-67961", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-01-29T00:11:18.100778Z", "version": "2.0.3"}}]}, "published": "2026-01-22T17:16:05.757", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/wpo365-login/vulnerability/wordpress-wpo365-plugin-40-0-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-28T09:57:22.555786+00:00", "value": {"mitigation_remediation": ["Upgrade the WPO365 plugin to a version newer than 40.0, which removes the SSRF vulnerability. This is the officially recommended fix.", "If upgrading immediately is not possible, disable or uninstall the WPO365 plugin until a patch is available to prevent any interaction with the vulnerable code path.", "Configure the web server or WAF to block outbound requests originating from the WordPress environment that are not explicitly whitelisted; this mitigates the risk of SSRF by restricting network reachability.", "Validate all URL inputs using strict allowlist checks on the server side to address the core weakness described by CWE\u2011918, ensuring that only approved destinations can be accessed by the plugin."], "summary": {"action": "Patch", "impact": "Server Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress WPO365 login plugin made by Marco van Wieren, versions up to and including 40.0. If the plugin is installed on a WordPress site, any user able to interact with the plugin\u2019s input fields could exploit the flaw.", "description_and_impact": "An SSRF flaw in the WPO365 plugin allows an attacker to trick the plugin into issuing requests to arbitrary URLs. This capability can expose internal network resources or transfer sensitive data to an attacker-controlled endpoint, thereby compromising confidentiality and potentially enabling further attacks such as credential theft or service disruption.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate risk, and an EPSS score below 1% suggests exploitation is unlikely in the near term. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require the attacker to supply a malicious request parameter to the plugin, which the plugin then forwards to a target URL, typically originating from within the web application environment."}}}}, "created": "2026-01-23T16:31:01.832072+00:00", "updated": "2026-04-28T10:00:06.507028+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}