CVE-2025-8013

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-8013", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-07-22T00:27:02.341Z", "datePublished": "2025-08-15T06:40:40.786Z", "dateUpdated": "2026-04-08T16:48:26.781Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:26.781Z"}, "affected": [{"vendor": "quttera", "product": "Quttera ThreatSign \u2013 Web Malware Scanner for WordPress", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.5.1.41", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352"}, {"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28"}, {"url": "https://plugins.trac.wordpress.org/changeset/3344330/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "baseScore": 3.8, "baseSeverity": "LOW"}}], "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "timeline": [{"time": "2025-08-14T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-08-15T12:10:03.404500Z", "id": "CVE-2025-8013", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T12:10:09.215Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-8013", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-08-15T12:10:03.404500Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-08-15T12:10:06.526Z"}}], "cna": {"title": "Quttera Web Malware Scanner <= 3.5.1.41 - Authenticated (Administrator+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Jonas Benjamin Friedli"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 3.8, "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "quttera", "product": "Quttera ThreatSign \u2013 Web Malware Scanner for WordPress", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.5.1.41"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-08-14T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352"}, {"url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28"}, {"url": "https://plugins.trac.wordpress.org/changeset/3344330/"}], "descriptions": [{"lang": "en", "value": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:48:26.781Z"}}}, "cveMetadata": {"cveId": "CVE-2025-8013", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:48:26.781Z", "dateReserved": "2025-07-22T00:27:02.341Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-08-15T06:40:40.786Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Quttera ThreatSign \u2013 Web Malware Scanner for WordPress", "vendor": "quttera", "versions": [{"lessThanOrEqual": "3.5.1.41", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Quttera Web Malware Scanner plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.5.1.41 via the 'RunExternalScan' function. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El complemento Quttera Web Malware Scanner para WordPress es vulnerable a Server-Side Request Forgery en todas las versiones hasta la 3.5.1.41 incluida, a trav\u00e9s de la funci\u00f3n \"RunExternalScan\". Esto permite a atacantes autenticados, con acceso de administrador o superior, realizar solicitudes web a ubicaciones arbitrarias desde la aplicaci\u00f3n web y utilizarlas para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-8013", "lastModified": "2026-06-17T10:06:08.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-8013", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-08-15T12:10:03.404500Z", "version": "2.0.3"}}]}, "published": "2025-08-15T07:15:28.963", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3344330/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T03:34:24.707026+00:00", "value": {"mitigation_remediation": ["Upgrade the Quttera Web Malware Scanner plugin to the latest version where the SSRF issue has been fixed (any release newer than 3.5.1.41).", "If an upgrade is temporarily infeasible, restrict the RunExternalScan capability by modifying the plugin's role permissions to deny administrator access to this function or by disabling the feature entirely.", "Apply network-level controls to block outbound connections from the WordPress application to internal IP ranges or untrusted addresses, thereby limiting the impact of any remaining SSRF vulnerabilities."], "summary": {"action": "Apply Patch", "impact": "Server\u2011Side Request Forgery"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Quttera ThreatSign \u2013 Web Malware Scanner for WordPress plugin in all releases up to and including version 3.5.1.41. Systems running any older version of WordPress that have this plugin installed with administrator access are impacted.", "description_and_impact": "The Quttera Web Malware Scanner plugin for WordPress contains a Server\u2011Side Request Forgery flaw. The RunExternalScan functionality allows an authenticated user with Administrator privileges to instruct the web application to send HTTP requests to arbitrary URLs. An attacker can leverage this to probe internal network services or modify data accessed by the plugin, potentially exposing sensitive information or enabling further compromise.", "risk_and_exploitability": "The CVSS score of 3.8 indicates low severity, and the EPSS score of less than 1\u202f% shows a very low likelihood of exploitation at present. The issue is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. Exploitability requires a valid administrator account and access to the plugin's external scan feature; once authenticated, an attacker can initiate internal requests and potentially gather or manipulate data from protected services."}}}}, "created": "2025-08-16T21:40:51.032503+00:00", "updated": "2026-04-21T03:45:27.372769+00:00", "vendors": ["quttera", "quttera$PRODUCT$quttera_web_malware_scanner", "wordpress", "wordpress$PRODUCT$wordpress"]}