CVE-2025-11128

Executive Summary

CVE-2025-11128 is a Server-Side Request Forgery (SSRF) vulnerability in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. The flaw resides in the feedzy_sanitize_feeds function, allowing authenticated attackers with Subscriber-level access or higher to make arbitrary HTTP requests from the web server. This can be abused to probe internal services, cloud metadata endpoints, or other internal resources, potentially leading to information disclosure or lateral movement.

This vulnerability is specific to the WordPress ecosystem and affects all versions up to and including 5.1.0. No patch is currently available, and no public exploit code or Nuclei template has been released. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for internal network reconnaissance.

Supply Chain & Package Security

This is a WordPress plugin vulnerability. The plugin is distributed via the official WordPress plugin repository and can be installed directly from the WordPress admin dashboard. Users should monitor the plugin’s page for updates and apply patches as soon as they become available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
• Base Score: 5.0 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low (information disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. While the CVSS score is moderate, the ability to scan internal networks from a WordPress server can be a stepping stone for more severe attacks.

Deep Dive & Mechanics

The vulnerability exists in the feedzy_sanitize_feeds function, which is responsible for validating and sanitizing feed URLs provided by users. The function fails to properly restrict the destination of HTTP requests made by the plugin. An authenticated attacker with Subscriber-level access can supply a malicious URL (e.g., http://169.254.169.254/latest/meta-data/) that the server will fetch, allowing the attacker to interact with internal services.

The core issue is the lack of a blocklist or allowlist for internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.169.254/32). The function only checks for basic URL validity but does not prevent requests to private or reserved IP addresses.

Vulnerable vs. Patched Code

Vulnerable Code (<= 5.1.0):

function feedzy_sanitize_feeds( $url ) {
    // Only basic URL validation
    if ( filter_var( $url, FILTER_VALIDATE_URL ) === false ) {
        return false;
    }
    // No check for internal IPs
    return $url;
}

Patched Code (Hypothetical):

function feedzy_sanitize_feeds( $url ) {
    if ( filter_var( $url, FILTER_VALIDATE_URL ) === false ) {
        return false;
    }
    $host = parse_url( $url, PHP_URL_HOST );
    $ip = gethostbyname( $host );
    // Block private and reserved IPs
    if ( filter_var( $ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE ) === false ) {
        return false;
    }
    return $url;
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress instance with Feedzy plugin <= 5.1.0
• Authenticated user with Subscriber role or higher

Exploitation Steps:

1. Log in to WordPress as a Subscriber.
2. Navigate to the Feedzy settings or feed creation page.
3. In the feed URL field, enter a malicious URL targeting internal services, e.g.:

   http://169.254.169.254/latest/meta-data/
   

4. Submit the feed. The plugin will fetch the URL and display the response (or store it in logs/database).
5. Extract sensitive information from the response.

Example Request (via Burp Suite or cURL):

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_logged_in_...

action=feedzy_fetch_feed&url=http://169.254.169.254/latest/meta-data/

Expected Output: The server will return the AWS metadata (if hosted on AWS), including IAM role credentials, instance ID, etc.

Blue Team (Detection & Hardening)

Detection:

• Monitor outbound HTTP requests from the web server to internal IP ranges.
• Look for requests to 169.254.169.254, 10.x.x.x, 172.16-31.x.x, 192.168.x.x.
• Alert on unusual User-Agent strings or repeated requests to internal IPs from the WordPress process.

Hardening:

• Apply a Web Application Firewall (WAF) rule to block requests to private IP ranges.
• Restrict outbound network access from the WordPress server using firewall rules or egress filtering.
• Disable the plugin until a patch is available.
• Implement a reverse proxy that blocks internal IPs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (AWS metadata)
  • Outbound HTTP requests to 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
  • Repeated requests to internal IPs from the WordPress server
• File IOCs:
  • Log entries in /var/log/apache2/access.log or /var/log/nginx/access.log showing requests to internal IPs
  • WordPress debug log entries containing internal IP responses
• Behavioral IOCs:
  • Subscriber-level users creating feeds with suspicious URLs
  • Unusual outbound connections from the web server

Detection Engineering

YARA Rule

rule CVE_2025_11128_SSRF_Feedzy {
    meta:
        description = "Detects SSRF attempts via Feedzy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-11128"
    strings:
        $ssrf_url = /http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/ nocase
        $feedzy_func = "feedzy_sanitize_feeds"
    condition:
        $feedzy_func and $ssrf_url
}

Sigma Rule

title: CVE-2025-11128 SSRF via Feedzy Plugin
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts targeting internal IPs via Feedzy plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'feedzy'
            - 'action=feedzy_fetch_feed'
        c-ip|startswith:
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '127.'
            - '169.254.'
    condition: selection
falsepositives:
    - Legitimate use of internal feeds (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-11128 SSRF Attempt via Feedzy Plugin";
    flow:to_server;
    content:"feedzy"; http_uri;
    content:"action=feedzy_fetch_feed"; http_uri;
    pcre:"/http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2[0-9]|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the Feedzy plugin until a patched version is released.
2. Implement egress filtering on the WordPress server to block outbound traffic to private IP ranges.
3. Apply a WAF rule to block requests containing internal IP addresses in the URL.
4. Monitor logs for SSRF attempts and investigate any suspicious activity.

Long-term Fix:

• The vendor must release a patched version that validates the destination IP and blocks requests to private/reserved ranges.
• Users should update to the latest version as soon as it becomes available.

Workaround:

• If the plugin cannot be disabled, modify the feedzy_sanitize_feeds function to include IP validation (as shown in the patched code example). However, this will be overwritten on plugin updates.

Valters IT
Securing Digital Frontiers