Description

Subscriber Server Side Request Forgery (SSRF) in Vehica Core <= 1.0.104 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.0",
  "pubDate": "2026-08-13T14:17:09.063Z",
  "pubdate": "2026-08-13T14:17:09.063Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability has been identified in the Vehica Core plugin affecting versions <= 1.0.104. This security flaw allows authenticated users with subscriber-level privileges to induce the host application to execute arbitrary outbound HTTP requests to internal or external destinations. Successful exploitation of this vulnerability can lead to severe security implications, including unauthorized access to internal network resources, metadata services, and backend systems that are typically isolated from the public internet. The attack requires authenticated subscriber access to the WordPress application, after which the malicious actor can leverage vulnerable functionality within the Vehica Core plugin to proxy requests. Organizations utilizing the affected versions face potential information disclosure and internal infrastructure mapping risks. Remediation requires updating the Vehica Core plugin beyond version 1.0.104 once a patched release is made available by the vendor, alongside implementing strict egress filtering and request validation mechanisms at the network perimeter.",
  "technicalDetails": "The vulnerability resides in the Vehica Core plugin, specifically affecting versions <= 1.0.104, manifesting as a Server-Side Request Forgery (SSRF) flaw accessible to users with subscriber privileges. The root cause stems from improper input sanitization and lack of validation on user-supplied URLs or endpoints before the application initiates backend HTTP requests. In typical attack scenarios, an authenticated attacker holding a low-privileged subscriber account interacts with specific plugin functionalities that process remote resources or fetch external data. When the application accepts an arbitrary URI supplied by the user without enforcing an allowlist or validating the destination schema, the underlying server-side HTTP client dereferences the malicious input. The attack flow initiates when the attacker crafts a malicious HTTP request directed at the vulnerable endpoint within Vehica Core, supplying a targeted internal IP address, loopback address (127.0.0.1), or sensitive cloud metadata service URL in place of a legitimate external resource. The vulnerable component processes the input and executes the outbound request on behalf of the attacker, subsequently returning response data or error states that may leak internal system information. Because the vulnerable functionality is exposed to the subscriber role, authentication is required, but privilege requirements are minimal. The network exposure encompasses any deployment where the WordPress instance is accessible and the Vehica Core plugin is active. Post-exploitation impact varies based on internal network architecture, potentially enabling attackers to interact with internal microservices, bypass firewalls protecting administrative interfaces, query cloud instance metadata endpoints for sensitive IAM credentials, or perform reconnaissance against adjacent internal infrastructure."
}