CVE-2025-14613
Published: 14 January 2026
Summary
CVE-2025-14613 is a high-severity SSRF (CWE-918) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 2.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-14613 is a Server-Side Request Forgery (SSRF) vulnerability, classified under CWE-918, affecting the GetContentFromURL plugin for WordPress in all versions up to and including 1.0. The flaw stems from the plugin's use of wp_remote_get() rather than the safer wp_safe_remote_get() to retrieve content from a user-supplied URL passed via the 'url' parameter in the [gcfu] shortcode. Published on 2026-01-14, it carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability by crafting shortcodes that trigger requests to arbitrary internal or external locations from the WordPress server's context. Successful exploitation allows attackers to query sensitive data or, in some cases, modify information on internal services not exposed to the public internet, potentially bypassing network restrictions.
Advisories reference the vulnerable code at line 20 in shortcode.class.php for both the 1.0 tag and trunk versions of the plugin, available via WordPress plugin trac repositories, along with a Wordfence threat intelligence entry providing further details on the issue. No specific patches or mitigations are detailed in the provided references.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2555
Vulnerability details
The GetContentFromURL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0. This is due to the plugin using wp_remote_get() instead of wp_safe_remote_get() to fetch content from a user-supplied URL in the 'url'…
more
parameter of the [gcfu] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
SSRF in public-facing WordPress plugin directly enables exploitation of the application to reach internal resources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires validation of the user-supplied 'url' parameter before wp_remote_get() is invoked, blocking the arbitrary SSRF requests described in the CVE.
Enforces information-flow policy that would deny the plugin's ability to initiate outbound requests to arbitrary internal or external destinations from contributor-supplied shortcodes.
Boundary-protection mechanisms can restrict or monitor the WordPress server's outbound connections, limiting the internal-service reconnaissance and modification possible via the vulnerable shortcode.