WordPress Plugin Vulnerabilities

LiteSpeed Cache < 7.1 - Editor+ Server-Side Request Forgery

Description

The plugin is vulnerable to Server-Side Request Forgery. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
litespeed-cache
Fixed in 7.1

References

CVE
CVE-2025-47437
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c96b9599-b1a5-4aa6-85fe-7af3f12d1776

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.5 (medium)

Miscellaneous

Original Researcher
TaiYou
Verified
No
WPVDB ID
a8033dc3-ed1b-4048-8566-a719d8c9ab52

Timeline

Publicly Published
2025-05-07 (about 10 months ago)
Added
2025-05-14 (about 9 months ago)
Last Updated
2025-05-14 (about 9 months ago)

Other

Published
Title
Published
2022-08-19
Title
Craw Data <= 1.0.0 - Server Side Request Forgery
Published
2024-06-20
Title
BlossomThemes Email Newsletter < 2.2.7 - Authenticated (Admin+) Server-Side Request Forgery
Published
2025-07-01
Title
Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
Published
2026-01-13
Title
GetContentFromURL <= 1.0 - Authenticated (Contributor+) Server-Side Request Forgery via 'url' Shortcode Attribute
Published
2025-10-17
Title
Essential Blocks < 5.7.2 - Authenticated (Author+) Server-Side Request Forgery