CVE-2025-14613

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The GetContentFromURL plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.0. This is due to the plugin using wp_remote_get() instead of wp_safe_remote_get() to fetch content from a user-supplied URL in the 'url' parameter of the [gcfu] shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published: Jan 14, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-146146.7Insecure Temporary File vulnerability in Altera Quartus Prime Standard Installer (SFX) on Windows, Altera Quartus Prime Lite Installer CVE-2025-146157.1The DASHBOARD BUILDER – WordPress plugin for Charts and Graphs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versi CVE-2025-146164.3The Recooty – Job Widget (Old Dashboard) plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includi CVE-2025-146175.3A vulnerability has been found in Jehovahs Witnesses JW Library App up to 15.5.1 on Android. Affected is an unknown function of the componen CVE-2025-146184.3The Sweet Energy Efficiency plugin for WordPress is vulnerable to unauthorized access, modification, and loss of data due to a missing capab CVE-2025-146199.8A vulnerability was found in code-projects Student File Management System 1.0. Affected by this vulnerability is an unknown functionality of CVE-2025-146209.8A vulnerability was determined in code-projects Student File Management System 1.0. Affected by this issue is some unknown functionality of CVE-2025-146219.8A vulnerability was identified in code-projects Student File Management System 1.0. This affects an unknown part of the file /admin/update_u CVE-2025-146229.8A security flaw has been discovered in code-projects Student File Management System 1.0. This vulnerability affects unknown code of the file CVE-2025-146239.8A weakness has been identified in code-projects Student File Management System 1.0. This issue affects some unknown processing of the file /CVE-2025-146256.7Uncontrolled Search Path Element vulnerability in Altera Quartus Prime Standard on Windows (Nios II Command Shell modules), Altera Quartus P CVE-2025-146266.4The QR Code for WooCommerce order emails, PDF invoices, packing slips plugin for WordPress is vulnerable to Stored Cross-Site Scripting via