CVE-2025-68893 MEDIUM

CVE-2025-68893: WordPress WordPress Image shrinker plugin <= 1.1.0 - Server Side Request Forgery (SSRF) vulnerability

Vendor Hetworks
Product WordPress Image shrinker
Weakness CWE-918 · SSRF
Published December 29, 2025
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.9/10
Attack vector Network
Attack complexity High
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in HETWORKS WordPress Image shrinker wp-image-shrinker allows Server Side Request Forgery.This issue affects WordPress Image shrinker: from n/a through <= 1.1.0.

Explanation of Vulnerability in Simple Terms

02Summary

The WordPress Image Shrinker plugin through version 1.1.0 contains a server-side request forgery vulnerability. An authenticated attacker with low privileges can make the site send HTTP requests to internal or external systems on their behalf. The attack requires specific conditions to succeed. This could expose internal services or be used to interact with external APIs.

What an attacker can do

03Attacker Capabilities

Make the site send HTTP requests to internal or external systems without authorization.

Potential impact on your site

04Site Impact

Attackers with basic WordPress access can probe internal networks or interact with external services via your site.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress account; no user interaction required.

Key dates

06Disclosure timeline

December 29, 2025 CVE published
April 28, 2026 Record updated