CVE-2025-1043 describes a Server-Side Request Forgery vulnerability (CWE-918) in the Embed Any Document – Embed PDF, Word, PowerPoint and Excel Files WordPress plugin. The flaw exists in all versions up to and including 2.7.5 and can be exploited by authenticated users with Contributor-level privileges or higher through the 'embeddoc' shortcode. This enables attackers to cause the server to make arbitrary HTTP requests to internal or external systems, potentially leading to information disclosure or modification of internal services. The vulnerability has a CVSS 3.1 base score of 6.4 (medium severity), with network attack vector, low attack complexity, required privileges, no user interaction, and impacts on confidentiality and integrity but not availability. A patch is available to remediate this vulnerability.

Exploitation allows authenticated users with Contributor-level access or higher to make arbitrary HTTP requests from the server hosting the plugin. This can lead to unauthorized querying and modification of internal services, potentially exposing sensitive information or altering internal data. The impact affects confidentiality and integrity but does not affect availability. No known exploits in the wild have been reported.

A patch is available for this vulnerability. Users of the Embed Any Document plugin should apply the official update to version 2.7.6 or later as soon as possible to remediate the SSRF issue. Until patched, restrict Contributor-level access to trusted users only to reduce risk.