CVE-2025-49984

Executive Summary

CVE-2025-49984 is a Server-Side Request Forgery (SSRF) vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress. This flaw allows an unauthenticated attacker to make the server send crafted HTTP requests to internal or external resources, potentially leading to information disclosure or internal network reconnaissance. The vulnerability affects all versions up to and including 11.13.11. No public proof-of-concept or patch is currently available, but the risk is elevated due to the widespread use of the PowerPress plugin in the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates from the vendor. No known malicious packages have been associated with this CVE.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The low EPSS score (0.0%) suggests limited active exploitation, but the lack of a patch and the plugin's popularity increase the threat level for targeted attacks.

Deep Dive & Mechanics

The SSRF vulnerability in PowerPress Podcasting arises from insufficient validation of user-supplied URLs when the plugin fetches external resources (e.g., podcast feeds, media files, or artwork). An attacker can craft a malicious request that forces the server to make HTTP requests to arbitrary destinations, including internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or cloud metadata endpoints (e.g., 169.254.169.254).

The vulnerable code likely resides in functions that handle URL parameters without proper sanitization or allowlist validation. For example, the plugin may use wp_remote_get() or file_get_contents() with user input directly, enabling SSRF.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

$url = $_GET['feed_url'];
$response = wp_remote_get($url);

Patched Code (Conceptual):

$url = $_GET['feed_url'];
$allowed_hosts = array('example.com', 'feeds.example.com');
$parsed_url = parse_url($url);
if (in_array($parsed_url['host'], $allowed_hosts)) {
    $response = wp_remote_get($url);
} else {
    // Log and reject
}

The patch should implement a strict allowlist of permitted hosts and validate the URL scheme (e.g., only http and https).

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with PowerPress Podcasting <= 11.13.11.
2. Set up a listener on an internal IP (e.g., 10.0.0.1:8080) to capture SSRF requests.
3. Use the following payload to trigger SSRF:

curl -v "http://target/wp-admin/admin-ajax.php?action=powerpress_fetch_feed&feed_url=http://10.0.0.1:8080/test"

Exploitation Steps:

• Scan internal ports by varying the URL (e.g., http://127.0.0.1:3306).
• Access cloud metadata endpoints (e.g., http://169.254.169.254/latest/meta-data/).
• Use the SSRF to read local files via file:// protocol if supported.

Blue Team

Detection:

• Monitor outbound HTTP requests to unexpected internal IPs.
• Alert on requests to cloud metadata IPs (169.254.169.254).
• Review web server logs for suspicious feed_url parameters.

Hunting:

SELECT * FROM wp_options WHERE option_name LIKE '%powerpress%';

Indicators of Compromise (IOCs)

• Network: Outbound HTTP requests to internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x) from the WordPress server.
• Logs: Access logs showing feed_url parameter with internal IPs or unusual schemes (e.g., file://, gopher://).
• File System: Unexpected files in /tmp/ or web root created by SSRF responses.

Detection Engineering

YARA Rule

rule CVE_2025_49984_SSRF_PowerPress {
    meta:
        description = "Detects SSRF attempts against PowerPress Podcasting plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49984"
    strings:
        $s1 = "powerpress_fetch_feed" ascii wide nocase
        $s2 = "feed_url=" ascii wide nocase
        $s3 = "169.254.169.254" ascii wide nocase
        $s4 = "127.0.0.1" ascii wide nocase
    condition:
        any of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-49984 SSRF via PowerPress
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against PowerPress Podcasting plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'action=powerpress_fetch_feed'
            - 'feed_url='
    filter:
        cs-uri-query|contains:
            - 'example.com'
            - 'trustedfeed.com'
    condition: selection and not filter
falsepositives:
    - Legitimate feed fetching from allowed domains
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-49984 SSRF PowerPress"; flow:to_server,established; content:"powerpress_fetch_feed"; http_uri; content:"feed_url="; http_uri; pcre:"/feed_url=(https?:\/\/)?(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])|192\.168\.|169\.254\.)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the PowerPress plugin if not essential.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block requests containing feed_url= with internal IPs.
3. Long-term: Apply the vendor patch when released. If no patch is available, consider forking the plugin and adding URL validation.
4. Monitoring: Enable logging for all outbound HTTP requests and alert on anomalies.

Valters IT
DevSecOps & Cyber Threat Intelligence