CVE-2025-48294 MEDIUM

CVE-2025-48294: WordPress FG Drupal to WordPress plugin <= 3.90.0 - Server Side Request Forgery (SSRF) Vulnerability

Vendor Kerfred
Product FG Drupal to WordPress
Weakness CWE-918 · SSRF
Published July 16, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.4/10
Attack vector Network
Attack complexity High
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in Kerfred FG Drupal to WordPress fg-drupal-to-wp allows Server Side Request Forgery.This issue affects FG Drupal to WordPress: from n/a through <= 3.90.0.

Explanation of Vulnerability in Simple Terms

02Summary

The FG Drupal to WordPress plugin for WordPress contains a server-side request forgery (SSRF) vulnerability. An authenticated administrator can craft requests that cause the plugin to make HTTP calls to internal or external systems on their behalf. The vulnerability requires high privileges and complex attack conditions, limiting its practical impact. Update to a version newer than 3.90.0.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems on the attacker's behalf.

Potential impact on your site

04Site Impact

An admin account could be compromised or misused to probe internal networks or interact with external services.

Conditions required to exploit

05Prerequisites

Attacker must have WordPress administrator privileges and craft a specific request to trigger the vulnerability.

Key dates

06Disclosure timeline

July 16, 2025 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-5737 Independent Analytics <= 2.14.9 - Unauthenticated Server-Side Request Forgery via Tracking Route CVE-2026-11370 WP Meta SEO <= 4.5.18 - Authenticated (Contributor+) Server-Side Request Forgery via 'new_link' Parameter CVE-2026-7049 PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter CVE-2026-2290 Post Affiliate Pro <= 1.28.0 - Authenticated (Administrator+) Server-Side Request Forgery via 'Post Affiliate Pro URL' Field CVE-2026-0686 Webmention <= 5.6.2 - Unauthenticated Blind Server-Side Request Forgery