CVE-2025-14613 is a Server-Side Request Forgery vulnerability in the daschmi GetContentFromURL WordPress plugin. The plugin improperly uses wp_remote_get() to retrieve content from a user-controlled URL parameter, allowing authenticated users with Contributor or higher privileges to induce the server to make arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services accessible from the server. The vulnerability affects all versions up to and including 1.0. No known exploits are reported in the wild, and no patch or remediation is currently documented.

An attacker with Contributor-level or higher access can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests to internal or external systems. This could lead to unauthorized information disclosure or modification of internal services that are otherwise inaccessible externally. The vulnerability does not directly allow remote code execution or denial of service but can be a stepping stone for further attacks within the internal network.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Contributor-level access to trusted users only. Monitor plugin updates from daschmi for a patch that replaces wp_remote_get() with wp_safe_remote_get() or otherwise mitigates the SSRF risk. Avoid using the [gcfu] shortcode with untrusted input.