What the vulnerability does
01Description
The Emplibot – AI Content Writer with Keyword Research, Infographics, and Linking | SEO Optimized | Fully Automated plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0.9 via the emplibot_call_webhook_with_error() and emplibot_process_zip_data() functions. This makes it possible for authenticated attackers, with Administrator-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
02Summary
Emplibot versions up to 1.0.9 contain a server-side request forgery vulnerability that allows high-privilege users to make the site send requests to internal or external systems on their behalf. The attacker must have administrative access and the impact is limited to reading non-sensitive data or making minor modifications. This affects the broader system scope but does not compromise availability.
What an attacker can do
03Attacker Capabilities
Make the site send HTTP requests to internal systems or external servers to read data or trigger actions.
Potential impact on your site
04Site Impact
An admin account compromise could allow an attacker to probe your internal network or interact with external APIs on your site's behalf.
Conditions required to exploit
05Prerequisites
Attacker must have high-level administrative privileges; no user interaction required.
Key dates
06Disclosure timeline
December 13, 2025
CVE published
April 8, 2026
Record updated
