CVE-2025-14613: SSRF in GetContentFromURL WordPress Plugin

The SSRF vulnerability in GetContentFromURL allows an attacker to craft malicious requests through the [gcfu] shortcode's 'url' parameter. Because the plugin utilizes wpremoteget() instead of the safer wpsaferemote_get(), it doesn't properly sanitize the user-supplied URL. This enables an attacker to make requests to internal services that are not directly accessible from the outside, potentially exposing sensitive data or allowing modification of internal configurations. A successful attack could lead to information disclosure, privilege escalation, or even remote code execution if internal services are vulnerable. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the WordPress server.

1. Reserved2025-12-12
2. Published2026-01-14
3. Modified2026-04-08
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-14613 is to upgrade to a patched version of the GetContentFromURL plugin as soon as it becomes available. In the interim, several workarounds can be implemented. A Web Application Firewall (WAF) can be configured to block requests to suspicious or internal IP addresses. Additionally, restrict access to the [gcfu] shortcode to only trusted users. Consider implementing input validation on the 'url' parameter to prevent malicious URLs. Monitor WordPress access logs for unusual outbound requests originating from the plugin.