CVE-2025-7843
Last modified
CVE-2025-7843 is a medium-severity vulnerability rated 6.4/10 on the CVSS scale. The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.
Description
The Auto Save Remote Images (Drafts) plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the fetch_images() function. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Metrics
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-7843?
How severe is CVE-2025-7843?
How do I fix CVE-2025-7843?
How Strix Helps
- One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-7837A vulnerability was found in TOTOLINK T6 4.1.5cu.748_B202110…8.8
- CVE-2025-7838A vulnerability has been found in Campcodes Online Movie The…9.8
- CVE-2025-7839The Restore Permanently delete Post or Page Data plugin for …4.3
- CVE-2025-7840A vulnerability was found in Campcodes Online Movie Theater …6.1
- CVE-2025-7841The Sertifier Certificate & Badge Maker for WordPress – Tuto…4.3
- CVE-2025-7842The Silencesoft RSS Reader plugin for WordPress is vulnerabl…4.3
- CVE-2025-7844Exporting a TPM based RSA key larger than 2048 bits from the…1
- CVE-2025-7845The Stratum – Elementor Widgets plugin for WordPress is vuln…6.4
- CVE-2025-7846The WordPress User Extra Fields plugin for WordPress is vuln…8.8
- CVE-2025-7847The AI Engine plugin for WordPress is vulnerable to arbitrar…8.8
- CVE-2025-7848A memory corruption vulnerability due to improper input vali…8.5
- CVE-2025-7849A memory corruption vulnerability due to improper error hand…8.5
Are you affected by CVE-2025-7843?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST