Server-Side Request Forgery in WP Scraper Plugin for WordPress

CVE-2025-9975

What is CVE-2025-9975?

The WP Scraper plugin for WordPress exposes a vulnerability that enables Server-Side Request Forgery (SSRF). This flaw affects all versions up to and including 5.8.1 through the wp_scraper_extract_content function. Authenticated users with Administrator-level access can exploit this vulnerability to issue web requests to arbitrary locations from the web application. This could allow them to query and potentially alter information from internal services. Additionally, on Cloud instances, the vulnerability permits the retrieval of sensitive metadata, raising significant security concerns.

References