CVE-2025-62088
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WordPress & WooCommerce Scraper Plugin up to version 1.0.7 has a Server-Side Request Forgery (SSRF) vulnerability. This allows sending requests from the server to internal resources, which can lead to exposure of sensitive information.
Risk Assessment
SSRF can be used to scan internal networks, access administrative services, or attack other systems. It is recommended to update the plugin immediately and restrict outbound network traffic.
Recommendation
Update WordPress & WooCommerce Scraper Plugin to the latest version, configure firewalls, and use allowlists for outbound IP addresses.
Other vulnerabilities in WordPress & WooCommerce Scraper Plugin
See all- CVE-2025-69129Critical
The WordPress & WooCommerce Scraper plugin versions <= 1.0.7 allows unauthenticated arbitrary file uploads.
- CVE-2025-69131High
The WordPress & WooCommerce Scraper plugin versions <= 1.0.7 allows unauthenticated arbitrary file downloads. This issue arises from improper input validation.
Original NVD description (English source)
Server-Side Request Forgery (SSRF) vulnerability in extendons WordPress & WooCommerce Scraper Plugin, Import Data from Any Site wp_scraper allows Server Side Request Forgery.This issue affects WordPress & WooCommerce Scraper Plugin, Import Data from Any Site: from n/a through <= 1.0.7.