CVE-2025-13174: rachelos WeRSS we-mp-rss Webhook mps.py do_job server-side request forgery

Severity: medium (CVSS 6.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-11-14 · updated 2026-10-07
Weakness: CWE-918

Description

A weakness has been identified in rachelos WeRSS we-mp-rss up to 1.4.7. Affected by this vulnerability is the function do_job of the file /rachelos/we-mp-rss/blob/main/jobs/mps.py of the component Webhook Module. Executing manipulation of the argument web_hook_url can lead to server-side request forgery. The attack may be launched remotely. The exploit has been made available to the public and could be exploited.

Affected products

rachelos WeRSS we-mp-rss: 1.4.0, 1.4.1, 1.4.2, 1.4.3, 1.4.4, 1.4.5 (+2)

References

https://vuldb.com/?ctiid.332465
https://vuldb.com/?id.332465
https://vuldb.com/?submit.684803
https://www.notion.so/SSRF-vulnerability-in-WeRSS-WebHook-module-29bea92a3c4180a192b5caa9078bfb18

Get alerted when CVE-2025-13174 or the next vulnerability affects your stack