CVE-2025-13999: SSRF in HTML5 Audio Player WordPress Plugin

The SSRF vulnerability in the HTML5 Audio Player plugin enables attackers to bypass security controls and interact with internal resources that are not directly accessible from the outside. An attacker could leverage this to query internal APIs, potentially exposing sensitive data such as database credentials, configuration files, or internal service status. Furthermore, the attacker might be able to modify data within internal systems if the targeted service allows it. This could lead to data breaches, denial of service, or even complete system compromise. The ability to make arbitrary requests significantly expands the attack surface beyond the plugin itself.

1. Reserved2025-12-03
2. Published2025-12-18
3. Modified2025-12-19
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-13999 is to immediately upgrade the HTML5 Audio Player plugin to version 2.5.2 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing a Web Application Firewall (WAF) rule to block outbound requests originating from the getIcyMetadata() function. Restrict network access to the WordPress server to only allow necessary outbound connections. Monitor web server access logs for unusual outbound requests originating from the plugin’s directory. After upgrading, confirm the fix by attempting to trigger the getIcyMetadata() function with a known internal resource and verifying that the request is blocked or handled appropriately.

Active installs

10KNiche

Plugin rating