CVE-2025-11467

Executive Summary

CVE-2025-11467 is a Blind Server-Side Request Forgery (SSRF) vulnerability discovered in the RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator WordPress plugin. The flaw resides in the feedzy_lazy_load function, affecting all versions up to and including 5.1.1. An unauthenticated attacker can exploit this to make arbitrary web requests from the vulnerable server, potentially querying or modifying data from internal services that are not intended to be exposed. This is a WordPress ecosystem issue and does not involve Apache or Nginx directly.

The vulnerability has a CVSS score of 5.8 (Medium), with an EPSS score of 0.0% indicating low exploitation likelihood currently. No public proof-of-concept (PoC) code or patch is available at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should monitor for updates from the vendor (Feedzy) and apply patches as soon as they become available. Since this is a WordPress plugin, supply chain risks include compromised plugin updates or malicious forks.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The threat level is considered Medium due to the ability to perform blind SSRF attacks, which can lead to information disclosure and limited modification of internal services.

Deep Dive & Mechanics

The vulnerability exists in the feedzy_lazy_load function, which is used to asynchronously load RSS feed content. The function accepts user-supplied URLs without proper validation or sanitization, allowing an attacker to craft requests that force the server to make HTTP requests to arbitrary destinations.

Root Cause: The plugin fails to validate the target URL against a whitelist of allowed domains or IP ranges. This allows an attacker to specify internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or cloud metadata endpoints (e.g., 169.254.169.254) as the feed source.

Attack Flow:

1. An unauthenticated attacker sends a crafted HTTP request to the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=feedzy_lazy_load).
2. The request includes a malicious URL parameter pointing to an internal service.
3. The server initiates an HTTP request to the attacker-specified URL.
4. The attacker can observe the response (blindly) or use timing/error-based techniques to infer information.

Impact:

• Query internal services (e.g., databases, configuration endpoints).
• Modify data on internal services if they accept write operations via HTTP.
• Potentially pivot to other internal systems.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is identified as the feedzy_lazy_load function in the plugin's main PHP file. The function likely uses wp_remote_get() or file_get_contents() without proper URL validation.

Vulnerable Code (Conceptual):

function feedzy_lazy_load() {
    $url = $_POST['url'];
    $response = wp_remote_get($url);
    // Process response...
}

Patched Code (Expected):

function feedzy_lazy_load() {
    $url = $_POST['url'];
    $parsed_url = parse_url($url);
    $host = $parsed_url['host'];
    // Validate host against whitelist
    if (!in_array($host, $allowed_domains)) {
        wp_die('Invalid URL');
    }
    $response = wp_remote_get($url);
    // Process response...
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Feedzy plugin version <= 5.1.1.
• Attacker machine with network access to the WordPress server.

Exploitation Steps:

1. Identify the vulnerable endpoint: /wp-admin/admin-ajax.php?action=feedzy_lazy_load.
2. Craft a POST request with a malicious URL parameter:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=feedzy_lazy_load&url=http://169.254.169.254/latest/meta-data/"
   

3. Observe the response (blindly). Use timing attacks or error messages to infer success.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from the WordPress server to internal IP ranges.
• Look for requests to cloud metadata endpoints (169.254.169.254) or localhost (127.0.0.1).
• Analyze web server logs for admin-ajax.php requests with suspicious url parameters.

Hunting:

• Search for feedzy_lazy_load in web server logs.
• Correlate with outbound connections to non-standard destinations.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16).
  • Requests to cloud metadata IPs (169.254.169.254).
  • Requests to localhost (127.0.0.1, ::1).

• File IOCs:

  • Modified plugin files (e.g., feedzy-rss-feeds.php).
  • Suspicious entries in WordPress options table.

• Log IOCs:

  • Repeated admin-ajax.php requests with action=feedzy_lazy_load.
  • Error logs showing failed connections to internal services.

Detection Engineering

YARA Rule

rule CVE_2025_11467_Feedzy_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2025-11467 in Feedzy plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-11467"
    strings:
        $s1 = "feedzy_lazy_load" ascii wide nocase
        $s2 = "admin-ajax.php" ascii wide nocase
        $s3 = "url=" ascii wide nocase
        $ip1 = "169.254.169.254" ascii wide nocase
        $ip2 = "127.0.0.1" ascii wide nocase
        $ip3 = "10." ascii wide nocase
        $ip4 = "172." ascii wide nocase
        $ip5 = "192.168." ascii wide nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($ip1, $ip2, $ip3, $ip4, $ip5)
}

Sigma Rule

title: CVE-2025-11467 Feedzy SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests targeting internal IPs via Feedzy plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "action=feedzy_lazy_load"
        cs-uri-query|contains: "url="
    internal_ips:
        cs-uri-query|contains:
            - "169.254.169.254"
            - "127.0.0.1"
            - "10."
            - "172."
            - "192.168."
    condition: selection and internal_ips
falsepositives:
    - Legitimate use of internal feeds (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11467 Feedzy SSRF Exploitation Attempt"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=feedzy_lazy_load"; http_client_body; content:"url="; http_client_body; pcre:"/url=(https?:\/\/)?(127\.0\.0\.1|169\.254\.169\.254|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Feedzy plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests to internal IPs via admin-ajax.php.
3. Restrict outbound HTTP access from the WordPress server to only trusted destinations.

Long-term Fix:

• Apply the official patch from Feedzy when released.
• Update to a patched version (currently unknown).

Workarounds:

• Use a reverse proxy to filter outbound requests.
• Implement network segmentation to limit access to internal services.

Valters IT