The Blog2Social WordPress plugin contains an SSRF vulnerability (CWE-918) in the getFullContent() function affecting all versions up to 8.6.0. Authenticated attackers with low privileges (Subscriber and above) can exploit this to make arbitrary HTTP requests originating from the server hosting the plugin. This could allow attackers to interact with internal network services or resources that are otherwise inaccessible externally. The vulnerability is publicly known and assigned CVE-2025-12560 with a CVSS 3.1 base score of 4.3, indicating medium severity. There is no vendor advisory or patch information available at this time.

An attacker with Subscriber-level access or higher can leverage this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server. This may enable the attacker to access or manipulate internal services or resources that are not directly exposed to the internet. The vulnerability does not directly impact confidentiality but can lead to integrity issues by modifying internal information. Availability is not affected. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to limit Subscriber-level access to trusted users only. Monitor for suspicious activity related to the plugin and consider disabling or removing the plugin if it is not essential.