GetContentFromURL <= 1.0 - Forgeage de Requête Côté Serveur Authentifié (Contributeur+) via l'Attribut 'url' du Shortcode

The SSRF vulnerability in GetContentFromURL allows an attacker to craft malicious requests through the [gcfu] shortcode's 'url' parameter. Because the plugin utilizes wpremoteget() instead of the safer wpsaferemote_get(), it doesn't properly sanitize the user-supplied URL. This enables an attacker to make requests to internal services that are not directly accessible from the outside, potentially exposing sensitive data or allowing modification of internal configurations. A successful attack could lead to information disclosure, privilege escalation, or even remote code execution if internal services are vulnerable. The blast radius extends to any internal resources accessible via HTTP/HTTPS from the WordPress server.

WordPress websites utilizing the GetContentFromURL plugin, particularly those with users having Contributor or higher access levels, are at risk. Shared hosting environments where users have limited control over plugin installations are also particularly vulnerable. Sites with legacy configurations or those lacking robust WAF protection are more susceptible to exploitation.

• wordpress / plugin: Use wp-cli to check plugin versions: wp plugin list --status=active. Look for GetContentFromURL versions prior to the patched version (once released). • generic web: Monitor access logs for outbound requests to unusual or internal IP addresses originating from the WordPress server.

 grep "gcfu shortcode" /var/log/apache2/access.log | grep "internal.domain.com" 

1. 2026-01-14Disclosure

   disclosure

1. Réservé2025-12-12
2. Publiée2026-01-14
3. Modifiée2026-04-08
4. EPSS mis à jour2026-03-23

The primary mitigation for CVE-2025-14613 is to upgrade to a patched version of the GetContentFromURL plugin as soon as it becomes available. In the interim, several workarounds can be implemented. A Web Application Firewall (WAF) can be configured to block requests to suspicious or internal IP addresses. Additionally, restrict access to the [gcfu] shortcode to only trusted users. Consider implementing input validation on the 'url' parameter to prevent malicious URLs. Monitor WordPress access logs for unusual outbound requests originating from the plugin.