CVE-2025-2109

Executive Summary

CVE-2025-2109 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the WP Compress – Instant Performance & Speed Optimization plugin for WordPress. The flaw resides in the init() function and affects all versions up to and including 6.30.15. An unauthenticated attacker can exploit this to make arbitrary HTTP requests from the web server, potentially accessing internal services, cloud metadata endpoints, or other internal resources that are not intended to be exposed. The vulnerability has a CVSS score of 5.8 (Medium) and currently has no known public exploit code or patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches as soon as they become available. Since the patch status is unknown, immediate mitigation steps should be taken.

CVSS Breakdown & Threat Level

• CVSS Score: 5.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed (impact on resources beyond the vulnerable component)
• Confidentiality Impact: Low (potential information disclosure from internal services)
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the low complexity and no authentication requirement, but the impact is limited to information disclosure.

Deep Dive & Mechanics

The vulnerability exists in the init() function of the WP Compress plugin. This function is called during plugin initialization and processes user-supplied input to construct URLs for fetching resources (e.g., images, CSS, JS) from external or internal servers. Due to insufficient validation of the URL scheme and host, an attacker can manipulate the input to force the server to make requests to arbitrary destinations, including internal IP addresses (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or cloud metadata endpoints (e.g., http://169.254.169.254/).

The attack flow:

1. An unauthenticated attacker sends a crafted HTTP request to the WordPress site with a malicious URL parameter.
2. The init() function processes this parameter without proper validation.
3. The server makes an HTTP request to the attacker-specified destination.
4. The response (if any) may be reflected back to the attacker or used in further attacks.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code pattern is as follows:

Vulnerable Code (simplified):

function init() {
    $url = $_GET['url'];
    $response = wp_remote_get($url);
    // Process response...
}

Patched Code (expected):

function init() {
    $url = $_GET['url'];
    // Validate URL scheme and host
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['scheme'], ['http', 'https'])) {
        return;
    }
    $host = $parsed_url['host'];
    // Block private IP ranges
    if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
        return;
    }
    $response = wp_remote_get($url);
    // Process response...
}

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

• WordPress instance with WP Compress plugin version 6.30.15 installed and activated.
• Attacker machine with curl or Burp Suite.

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-content/plugins/wp-compress/init.php or similar).
2. Send a request with a malicious url parameter:

   curl "http://target.com/wp-content/plugins/wp-compress/init.php?url=http://169.254.169.254/latest/meta-data/"
   

3. Observe the response for cloud metadata or internal service data.

Note: No public exploit code is available; this is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection:

• Monitor outbound HTTP requests from the web server to unexpected destinations.
• Look for requests to private IP ranges or cloud metadata IPs.
• Use WAF rules to block SSRF patterns.

Hunting Query (Splunk):

index=web sourcetype=access_combined
| search uri=*wp-compress* url=*
| rex field=uri "url=(?<target_url>[^&]+)"
| where match(target_url, "^(http|https)://(127\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|169\.254\.)")
| table _time, src_ip, target_url

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16)
  • Requests to cloud metadata IPs (169.254.169.254)
  • Unusual User-Agent strings (e.g., empty or non-standard)
• File IOCs:
  • Modified or suspicious log entries in /var/log/apache2/access.log or /var/log/nginx/access.log
• Behavioral IOCs:
  • Unexpected increase in outbound traffic from the web server
  • Plugin files with recent modification timestamps

Detection Engineering

YARA Rule

rule CVE_2025_2109_SSRF {
    meta:
        description = "Detects SSRF exploitation attempts against WP Compress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-2109"
    strings:
        $url_param = "url=" nocase
        $private_ip = /(127\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|169\.254\.)/ nocase
        $wp_compress = "wp-compress" nocase
    condition:
        all of them
}

Sigma Rule

title: SSRF Exploitation via WP Compress Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against WP Compress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "url="
        cs-uri-query|contains: "wp-compress"
    filter:
        cs-uri-query|contains:
            - "http://"
            - "https://"
    condition: selection and not filter
falsepositives:
    - Legitimate plugin functionality
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2109 WP Compress SSRF Attempt"; flow:to_server; content:"wp-compress"; http_uri; content:"url="; http_uri; pcre:"/url=(http|https):\/\/(127\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|169\.254\.)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block requests containing url= parameter with private IP addresses.
3. Restrict outbound traffic from the web server using firewall rules (e.g., block outbound to private IP ranges).

Long-term Fix:

• Apply the official patch once released by the vendor.
• Conduct a code review of the plugin to ensure proper input validation and URL sanitization.

Workaround:

• Add the following to .htaccess or Nginx config to block SSRF attempts:

  RewriteCond %{QUERY_STRING} url=(http|https)://(127\.|10\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|192\.168\.|169\.254\.) [NC]
  RewriteRule ^.* - [F,L]
  

Valters IT
Securing Digital Frontiers