WordPress Oxygenテーマ <= 6.0.8 - サーバーサイドリクエストフォージェリ (SSRF) 脆弱性

The SSRF vulnerability in Laborator Oxygen allows an attacker to craft malicious requests that the plugin will execute on behalf of the server. This can be exploited to access internal services that are not directly exposed to the internet, such as databases, administrative panels, or other internal APIs. Successful exploitation could lead to data breaches, privilege escalation, and even complete system compromise. The attacker could potentially scan internal networks, read sensitive configuration files, or even interact with other internal systems, expanding the blast radius of the attack. While no direct precedent exists for this specific plugin, SSRF vulnerabilities are frequently exploited to bypass security controls and gain unauthorized access to sensitive data.

WordPress websites utilizing the Laborator Oxygen plugin, particularly those with sensitive internal services accessible from the web server, are at risk. Shared hosting environments where Oxygen is installed are also vulnerable, as a compromised Oxygen instance could potentially impact other websites on the same server.

• wordpress / composer / npm:

grep -r 'http_request' /var/www/html/wp-content/plugins/oxygen/

• generic web:

curl -I https://your-wordpress-site.com/wp-content/plugins/oxygen/ | grep Server

1. 予約済み2025-12-31
2. 公開日2026-02-20
3. 更新日2026-04-28
4. EPSS 更新日2026-03-23

Due to the lack of a provided fixed version, immediate mitigation strategies are crucial. As a temporary workaround, implement strict input validation on any URLs or URIs processed by the Oxygen plugin. Consider using a Web Application Firewall (WAF) with SSRF protection rules to block malicious requests. Restrict network access for the Oxygen plugin to only the necessary resources. Regularly monitor Oxygen plugin logs for suspicious activity, looking for unexpected outbound requests. After a patched version is released, upgrade immediately and verify the fix by attempting a controlled SSRF request to an internal resource to confirm it is blocked.