CVE-2025-53241 MEDIUM

CVE-2025-53241: WordPress Simplified plugin <= 1.0.11 - Server Side Request Forgery (SSRF) vulnerability

Vendor Kodeshpa
Product Simplified
Weakness CWE-918 · SSRF
Published August 14, 2025
Last update May 12, 2026
View on NVD All CVEs

CVSS base score

5.5/10
Attack vector Network
Attack complexity Low
Privileges required High
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in kodeshpa Simplified simplified allows Server Side Request Forgery.This issue affects Simplified: from n/a through <= 1.0.11.

Explanation of Vulnerability in Simple Terms

02Summary

Kodeshpa Simplified versions up to 1.0.11 contain a server-side request forgery vulnerability that allows high-privilege users to make the application send HTTP requests to internal or external systems on their behalf. The vulnerability requires administrative access and does not directly impact confidentiality or availability, but can be used to probe internal infrastructure or interact with restricted services.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems without direct user knowledge.

Potential impact on your site

04Site Impact

Administrators with malicious intent or compromised admin accounts can probe your internal network or interact with restricted external services.

Conditions required to exploit

05Prerequisites

Attacker must have high-privilege (administrative) access to the application.

Key dates

06Disclosure timeline

August 14, 2025 CVE published
May 12, 2026 Record updated