CVE-2025-14793 is a Server-Side Request Forgery vulnerability (CWE-918) in the DK PDF – WordPress PDF Generator plugin for WordPress, affecting all versions up to 2.3.0. The issue exists in the 'addContentToMpdf' function, which allows authenticated users with author-level or higher privileges to induce the server to make HTTP requests to arbitrary locations. This can be leveraged to interact with internal network services that are otherwise inaccessible externally. The vulnerability has a CVSS 3.1 base score of 5.0 (medium severity), with an attack vector of network, low attack complexity, requiring privileges at the author level, no user interaction, and impacts confidentiality partially without affecting integrity or availability.

An authenticated attacker with author-level privileges or higher can exploit this SSRF vulnerability to make arbitrary HTTP requests from the WordPress server. This can lead to unauthorized querying or modification of internal services that are accessible from the server's network environment. The impact is limited to partial confidentiality loss; integrity and availability are not affected according to the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict author-level user privileges to trusted users only and monitor for suspicious activity related to the plugin. Consider disabling or removing the DK PDF – WordPress PDF Generator plugin if it is not essential. Follow vendor updates closely for any forthcoming patches or official mitigations.