PT-2025-41684 · WordPress · Wp Scraper

Valatty + 1 · Published 2025-10-11 · Updated 2025-10-11 · CVE-2025-9975

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions WP Scraper plugin for WordPress versions prior to 5.8.2

Description The WP Scraper plugin for WordPress is susceptible to Server-Side Request Forgery (SSRF) in versions up to and including 5.8.1. This flaw resides within the wp scraper extract content function and permits authenticated attackers possessing Administrator-level privileges or higher to initiate web requests to arbitrary locations from the web application. This capability can be leveraged to query and modify information from internal services. In Cloud environments, this issue enables the retrieval of metadata.

Recommendations Update the WP Scraper plugin to version 5.8.2 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-9975

Affected Products

Wp Scraper

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-9975 · Security Note
• https://twitter.com/CVEnew/status/1976948524769263819 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/4c72abf9-f63d-4460-8c9b-10e3f65b71ba?source=cve · Note
• https://plugins.trac.wordpress.org/browser/wp-scraper/tags/5.8.1/wp-scraper.php#L688 · Note
• https://twitter.com/VulmonFeeds/status/1977019369252176020 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3396219%40wp-scraper&new=3396219%40wp-scraper&sfp_email=&sfph_mail= · Note
• https://t.me/CVEtracker/34677 · Telegram Post