CVE-2025-11970
Server-Side Request Forgery in Emplibot WordPress Plugin
Publication date: 2025-12-13
Last updated on: 2025-12-13
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wordpress | emplibot | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-918 | The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability be detected on my network or system? Can you suggest some commands?
To detect this vulnerability on your system, you should check the version of the Emplibot WordPress plugin installed. Versions up to and including 1.0.9 are vulnerable. You can verify the plugin version via the WordPress admin dashboard or by checking the plugin files. Additionally, monitoring for unusual outbound web requests originating from the WordPress application, especially from authenticated administrator users, may indicate exploitation attempts. Since the vulnerability involves Server-Side Request Forgery via specific functions, reviewing logs for unexpected HTTP requests or using WordPress REST API calls to check the plugin version and configuration can help. For example, you can use WP-CLI commands to check the plugin version: `wp plugin list --status=active` or inspect the plugin files directly. Also, after updating to version 1.1.0 or later, the REST API endpoint `emplibot_get_version` provides information about the plugin version and configuration, which can be queried using curl or similar tools. Specific commands: 1. Check plugin version via WP-CLI: `wp plugin list | grep emplibot` 2. Query REST API endpoint (if accessible): `curl -X GET https://your-site.com/wp-json/emplibot/v1/emplibot_get_version` 3. Monitor web server logs for unusual outbound requests or internal service queries. Note that detection requires administrative access and monitoring capabilities. The update in version 1.1.0 includes sanitization and safer HTTP request handling to mitigate this vulnerability. [2]
Can you explain this vulnerability to me?
This vulnerability is a Server-Side Request Forgery (SSRF) in the Emplibot WordPress plugin (versions up to 1.0.9). It allows authenticated users with Administrator-level access or higher to make the web application send requests to arbitrary locations. This is possible through the functions emplibot_call_webhook_with_error() and emplibot_process_zip_data().
How can this vulnerability impact me? :
An attacker with Administrator-level access can exploit this vulnerability to make the web application send requests to internal or external systems. This can lead to unauthorized querying and modification of information from internal services, potentially exposing sensitive data or disrupting internal operations.
What immediate steps should I take to mitigate this vulnerability?
To mitigate the CVE-2025-11970 vulnerability in the Emplibot WordPress plugin, immediately update the plugin to version 1.1.0 or later. This update includes important security improvements such as input sanitization, safer HTTP request functions, and enhanced configuration options. Additionally, ensure your WordPress installation is version 6.4 or higher and PHP version is at least 7.2, as required by the updated plugin. Review and configure the new 'Upload Version' setting in the plugin's admin interface, preferably using the default 'v2' option unless issues arise. [2]