CVE-2025-9975 is an SSRF vulnerability in the WP Scraper plugin for WordPress, affecting all versions up to and including 5.8.1. The issue exists in the wp_scraper_extract_content function, which can be abused by authenticated administrators to initiate web requests to arbitrary locations from the server. This can be leveraged to access or modify internal services and, in cloud environments, to retrieve metadata. The vulnerability has a CVSS 3.1 base score of 6.8, reflecting a medium severity with high confidentiality impact but no integrity or availability impact. No patch or vendor advisory is currently available, and no known exploits are reported in the wild.

An attacker with Administrator-level access can exploit this SSRF vulnerability to make unauthorized requests from the server to internal or external resources. This can lead to unauthorized disclosure of sensitive information, including internal service data and cloud instance metadata. The vulnerability impacts confidentiality but does not affect integrity or availability. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict Administrator-level access to trusted users only and monitor for suspicious activity related to the WP Scraper plugin. Consider disabling or removing the plugin if it is not essential.