CVE-2025-31824 - Vulnerability Details

Link	Providers
https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve

Type	Values Removed	Values Added
Description	Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7.	Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7.

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7.
Title		WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability
Weaknesses		CWE-918
References		https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-31824", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2025-04-01T13:20:32.606Z", "datePublished": "2025-04-01T14:51:47.645Z", "dateUpdated": "2025-04-15T14:46:47.251Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "wp-optin-wheel", "product": "WP Optin Wheel", "vendor": "Wombat Plugins", "versions": [{"changes": [{"at": "1.4.8", "status": "unaffected"}], "lessThanOrEqual": "1.4.7", "status": "affected", "version": "n/a", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marek Mikita (Patchstack Alliance)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.</p><p>This issue affects WP Optin Wheel: from n/a through 1.4.7.</p>"}], "value": "Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.\n\nThis issue affects WP Optin Wheel: from n/a through 1.4.7."}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-04-15T14:46:47.251Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Update to&nbsp;1.4.8 or a higher version."}], "value": "Update to\u00a01.4.8 or a higher version."}], "source": {"discovery": "EXTERNAL"}, "tags": ["x_open-source"], "title": "WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-04-01T18:00:28.548873Z", "id": "CVE-2025-31824", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T18:00:34.766Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-31824 (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

state : PUBLISHED (string)

assignerShortName : Patchstack (string)

dateReserved : 2025-04-01T13:20:32.606Z (string)

datePublished : 2025-04-01T14:51:47.645Z (string)

dateUpdated : 2025-04-15T14:46:47.251Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

packageName : wp-optin-wheel (string)

product : WP Optin Wheel (string)

vendor : Wombat Plugins (string)

versions : [ »

0 : { »

changes : [ »

0 : { »

at : 1.4.8 (string)

status : unaffected (string)

}

]

lessThanOrEqual : 1.4.7 (string)

status : affected (string)

version : n/a (string)

versionType : custom (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Marek Mikita (Patchstack Alliance) (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through 1.4.7. (string)

}

]

value : Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-664 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-664 Server Side Request Forgery (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-918 (string)

description : CWE-918 Server-Side Request Forgery (SSRF) (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-04-15T14:46:47.251Z (string)

}

references : [ »

0 : { »

tags : [ »

0 : vdb-entry (string)

]

url : https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve (string)

}

]

solutions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Update to 1.4.8 or a higher version. (string)

}

]

value : Update to 1.4.8 or a higher version. (string)

}

]

source : { »

discovery : EXTERNAL (string)

}

tags : [ »

0 : x_open-source (string)

]

title : WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-04-01T18:00:28.548873Z (string)

id : CVE-2025-31824 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-01T18:00:34.766Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-31824", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-04-01T18:00:28.548873Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-04-01T18:00:31.745Z"}}], "cna": {"title": "WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "finder", "user": "00000000-0000-4000-9000-000000000000", "value": "Marek Mikita (Patchstack Alliance)"}], "impacts": [{"capecId": "CAPEC-664", "descriptions": [{"lang": "en", "value": "CAPEC-664 Server Side Request Forgery"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Wombat Plugins", "product": "WP Optin Wheel", "versions": [{"status": "affected", "version": "n/a", "versionType": "custom", "lessThanOrEqual": "1.4.7"}], "packageName": "wp-optin-wheel", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "references": [{"url": "https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7.", "supportingMedia": [{"type": "text/html", "value": "<p>Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.</p><p>This issue affects WP Optin Wheel: from n/a through 1.4.7.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2025-04-01T14:51:47.645Z"}}}, "cveMetadata": {"cveId": "CVE-2025-31824", "state": "PUBLISHED", "dateUpdated": "2025-04-01T18:00:34.766Z", "dateReserved": "2025-04-01T13:20:32.606Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2025-04-01T14:51:47.645Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-31824 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-04-01T18:00:28.548873Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-04-01T18:00:31.745Z (string)

}

]

cna : { »

title : WordPress WP Optin Wheel Plugin <= 1.4.7 - Server Side Request Forgery (SSRF) vulnerability (string)

source : { »

discovery : EXTERNAL (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

user : 00000000-0000-4000-9000-000000000000 (string)

value : Marek Mikita (Patchstack Alliance) (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-664 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-664 Server Side Request Forgery (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

scope : CHANGED (string)

version : 3.1 (string)

baseScore : 5.4 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : NONE (string)

attackComplexity : HIGH (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : LOW (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Wombat Plugins (string)

product : WP Optin Wheel (string)

versions : [ »

0 : { »

status : affected (string)

version : n/a (string)

versionType : custom (string)

lessThanOrEqual : 1.4.7 (string)

}

]

packageName : wp-optin-wheel (string)

collectionURL : https://wordpress.org/plugins (string)

defaultStatus : unaffected (string)

}

]

references : [ »

0 : { »

url : https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve (string)

tags : [ »

0 : vdb-entry (string)

]

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.This issue affects WP Optin Wheel: from n/a through 1.4.7. (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-918 (string)

description : CWE-918 Server-Side Request Forgery (SSRF) (string)

}

]

}

]

providerMetadata : { »

orgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

shortName : Patchstack (string)

dateUpdated : 2025-04-01T14:51:47.645Z (string)

}

cveMetadata : { »

cveId : CVE-2025-31824 (string)

state : PUBLISHED (string)

dateUpdated : 2025-04-01T18:00:34.766Z (string)

dateReserved : 2025-04-01T13:20:32.606Z (string)

assignerOrgId : 21595511-bba5-4825-b968-b78d1f9984a3 (string)

datePublished : 2025-04-01T14:51:47.645Z (string)

assignerShortName : Patchstack (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery.\n\nThis issue affects WP Optin Wheel: from n/a through 1.4.7."}, {"lang": "es", "value": "Vulnerabilidad de Server-Side Request Forgery (SSRF) en Wombat Plugins WP Optin Wheel permite Server-Side Request Forgery. Este problema afecta a WP Optin Wheel desde n/d hasta la versi\u00f3n 1.4.7."}], "id": "CVE-2025-31824", "lastModified": "2025-04-15T15:16:09.053", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 2.7, "source": "audit@patchstack.com", "type": "Secondary"}]}, "published": "2025-04-01T15:16:22.580", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Server-Side Request Forgery (SSRF) vulnerability in Wombat Plugins WP Optin Wheel allows Server Side Request Forgery. This issue affects WP Optin Wheel: from n/a through 1.4.7. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de Server-Side Request Forgery (SSRF) en Wombat Plugins WP Optin Wheel permite Server-Side Request Forgery. Este problema afecta a WP Optin Wheel desde n/d hasta la versión 1.4.7. (string)

}

]

id : CVE-2025-31824 (string)

lastModified : 2025-04-15T15:16:09.053 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : HIGH (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 5.4 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.2 (number)

impactScore : 2.7 (number)

source : audit@patchstack.com (string)

type : Secondary (string)

}

]

}

published : 2025-04-01T15:16:22.580 (string)

references : [ »

0 : { »

source : audit@patchstack.com (string)

url : https://patchstack.com/database/wordpress/plugin/wp-optin-wheel/vulnerability/wordpress-wp-optin-wheel-plugin-1-4-7-server-side-request-forgery-ssrf-vulnerability?_s_id=cve (string)

}

]

sourceIdentifier : audit@patchstack.com (string)

vulnStatus : Awaiting Analysis (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-918 (string)

}

]

source : audit@patchstack.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object