Server-Side Request Forgery Vulnerability in WPThumb by Joe Hoyle
CVE-2025-49983

4.9MEDIUM

Key Information:

Vendor

WordPress
Status
WPthumb
Vendor
CVE Published:
20 June 2025

What is CVE-2025-49983?

A Server-Side Request Forgery (SSRF) vulnerability exists in the WPThumb plugin by Joe Hoyle, versions from n/a to 0.10. This flaw allows an attacker to send crafted requests on behalf of the server, potentially leading to unauthorized access or exposure of sensitive data. Users of affected versions are advised to apply updates or mitigations promptly to safeguard their WordPress installations.

Affected Version(s)

WPThumb <= 0.10

References

https://patchstack.com/database/wordpress/plugin/wp-thumb...
vdb-entry

CVSS V3.1

Score:
4.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Tran Tuan Dung (domiee13) (Patchstack Alliance)
.
CVE-2025-49983 : Server-Side Request Forgery Vulnerability in WPThumb by Joe Hoyle