Server-Side Request Forgery Vulnerability in Blog2Social Plugin for WordPress

CVE-2025-12560

What is CVE-2025-12560?

The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress contains a vulnerability that allows authenticated attackers, with Subscriber-level access and higher, to exploit Server-Side Request Forgery via the getFullContent() function. This flaw permits the attacker to initiate web requests to arbitrary external locations from the web application itself, which can lead to unauthorized querying and modification of sensitive information from internal services.

References