CVE-2025-7843 is a Server-Side Request Forgery vulnerability (CWE-918) affecting the Auto Save Remote Images (Drafts) plugin for WordPress in all versions up to 1.0.9. The vulnerability exists in the fetch_images() function, allowing authenticated users with at least Contributor privileges to induce the server to make arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services accessible from the server. The CVSS 3.1 score is 6.4 (medium severity), with attack vector network, low attack complexity, and privileges required at the contributor level. No patch or remediation information is currently available from the vendor or other sources.

Successful exploitation allows an authenticated user with Contributor-level access or higher to perform SSRF attacks, potentially accessing or modifying internal services that are not directly exposed externally. This could lead to information disclosure or unauthorized internal network interactions. The impact is limited by the requirement for authenticated access with specific privileges and does not include direct denial of service or remote code execution.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to the plugin. Consider disabling or removing the Auto Save Remote Images (Drafts) plugin if it is not essential to reduce attack surface.