PT-2025-33447 · WordPress · Quttera Web Malware Scanner

Jonas Benjamin Friedli · Published 2025-08-15 · Updated 2025-08-15 · CVE-2025-8013

Positive Technologies (AI Summary)

CVSS v3.1

3.8

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Quttera Web Malware Scanner for WordPress versions up to and including 3.5.1.41

Description: The Quttera Web Malware Scanner plugin for WordPress is susceptible to Server-Side Request Forgery via the RunExternalScan function. Authenticated attackers with Administrator-level access or higher can leverage this issue to make web requests to arbitrary locations originating from the web application, potentially allowing them to query and modify information from internal services.

Recommendations: Versions prior to 3.5.1.42 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-8013

Affected Products

Quttera Web Malware Scanner

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-8013 · Security Note
• https://twitter.com/VulmonFeeds/status/1956345738029391960 · Twitter Post
• https://t.me/cveNotify/132399 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3344330 · Note
• https://t.me/CVEtracker/30093 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/40957153-45f1-40c9-91ce-f3491ca7eee5?source=cve · Note
• https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrExternalScanner.php#L28 · Note
• https://twitter.com/CVEnew/status/1956289029160493409 · Twitter Post
• https://plugins.trac.wordpress.org/browser/quttera-web-malware-scanner/trunk/qtrAjaxHandler.php#L352 · Note