CVE-2025-49418

Executive Summary

CVE-2025-49418 is a Server-Side Request Forgery (SSRF) vulnerability in the TeconceTheme Allmart WordPress plugin (allmart-core). This flaw allows an unauthenticated attacker to make arbitrary HTTP requests from the server, potentially accessing internal services, cloud metadata endpoints, or other restricted resources. The vulnerability affects all versions up to and including 1.0.0. No patch is currently available, and no public proof-of-concept (PoC) or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant due to the potential for internal network reconnaissance and data exfiltration.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository or third-party marketplaces. Users should verify the integrity of the plugin package and monitor for updates from the vendor. Since no patch exists, consider disabling or removing the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Score: 7.2 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact reflects the ability to read internal resources, but no write or denial-of-service capabilities are present.

Deep Dive & Mechanics

The SSRF vulnerability in allmart-core arises from improper validation of user-supplied URLs in a server-side request function. The plugin likely uses a function like wp_remote_get() or curl_exec() with a URL parameter that is not sanitized or restricted to allowed domains. An attacker can craft a request to the vulnerable endpoint, providing a URL pointing to internal services (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, http://localhost:9200 for Elasticsearch, or http://internal-admin/).

The vulnerability is triggered via a POST or GET request to a specific plugin endpoint (e.g., /wp-admin/admin-ajax.php?action=allmart_fetch_url). The plugin then fetches the provided URL and returns the response to the attacker, enabling data exfiltration.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code in allmart-core
function allmart_fetch_url() {
    $url = $_GET['url'];
    $response = wp_remote_get($url); // No validation
    echo wp_remote_retrieve_body($response);
    wp_die();
}
add_action('wp_ajax_nopriv_allmart_fetch_url', 'allmart_fetch_url');

A patched version would include:

// Patched code
function allmart_fetch_url() {
    $url = $_GET['url'];
    $parsed = parse_url($url);
    $allowed_hosts = array('api.example.com', 'cdn.example.com');
    if (!in_array($parsed['host'], $allowed_hosts)) {
        wp_die('Forbidden');
    }
    $response = wp_remote_get($url);
    echo wp_remote_retrieve_body($response);
    wp_die();
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with the Allmart plugin (version 1.0.0) on a local server (e.g., using Docker).
2. Ensure the server has internal services running (e.g., a simple HTTP server on port 8080).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., via admin-ajax.php?action=allmart_fetch_url).
2. Craft a request to fetch internal resources:

   curl "http://target.com/wp-admin/admin-ajax.php?action=allmart_fetch_url&url=http://127.0.0.1:8080/internal-secret.txt"
   

3. The response will contain the contents of the internal file.

Advanced Exploitation:

• Use SSRF to access cloud metadata endpoints (e.g., AWS, GCP, Azure).
• Chain with other vulnerabilities (e.g., port scanning via timing attacks).

Blue Team

Detection:

• Monitor for outbound HTTP requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Alert on requests to cloud metadata IPs (169.254.169.254, 100.100.100.200).
• Look for unusual URL parameters in admin-ajax.php actions.

Hunting:

• Search web server logs for action=allmart_fetch_url with suspicious url parameters.
• Use network flow logs to detect server-initiated connections to internal hosts.

Indicators of Compromise (IOCs)

• Network:
  • Outbound HTTP requests from the web server to internal IP addresses (e.g., 10.x.x.x, 192.168.x.x).
  • Requests to 169.254.169.254 or 100.100.100.200.
• File:
  • Log entries containing allmart_fetch_url with non-standard URLs.
• Behavioral:
  • Unexpected server-side HTTP requests to ports 9200, 6379, 3306, etc.

Detection Engineering

YARA Rule

rule CVE_2025_49418_SSRF_Allmart {
    meta:
        description = "Detects SSRF exploitation attempts against Allmart plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49418"
    strings:
        $action = "allmart_fetch_url"
        $url_param = "url="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $action and $url_param and $internal_ip
}

Sigma Rule

title: CVE-2025-49418 SSRF Exploitation via Allmart Plugin
id: 8a3b2c1d-4e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects SSRF attempts against the Allmart WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: "action=allmart_fetch_url"
        cs-uri-query|contains: "url="
    filter:
        cs-uri-query|contains:
            - "url=http://api.example.com"
            - "url=https://cdn.example.com"
    condition: selection and not filter
falsepositives:
    - Legitimate use of the plugin's fetch functionality (if any)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-49418 SSRF Exploitation - Allmart Plugin";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"action=allmart_fetch_url"; http_uri;
    content:"url="; http_uri;
    pcre:"/url=http:\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|127\.\d{1,3}\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3}\.\d{1,3})/";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

• Immediate: Disable or remove the Allmart plugin until a patch is released.
• Network: Implement egress filtering to block outbound requests to internal IP ranges from the web server.
• WAF: Deploy a Web Application Firewall rule to block requests containing action=allmart_fetch_url with internal IPs in the url parameter.
• Monitoring: Enable logging and alerting for SSRF patterns as described in Detection Engineering.
• Vendor: Contact TeconceTheme for a patch or consider switching to an alternative plugin.

Valters IT
Securing Digital Frontiers