CVE-2025-47548 is a medium severity server side request forgery flaw (CVSS 5.4) in Activity Link Preview For BuddyPress, versions through 1.4.4. The plugin can be made to send requests on the server's behalf. Patchstack lists 1.6.0 as the patched version, so update to that or later.
What's affected
The record says Wbcom Designs Activity Link Preview For BuddyPress is affected through 1.4.4. Patchstack lists 1.6.0 as the patched version, which is a larger jump than a patch release, so read the changelog before you update.
The vector marks the scope as changed, meaning the impact can reach beyond the plugin itself. Attack complexity is high, and confidentiality and integrity are affected at a low level.
The record does not mark CVE-2025-47548 as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.
How to check if you're exposed
On the server, WP-CLI shows the installed version and whether the plugin is active:
wp plugin list --name=activity-link-preview-for-buddypress --fields=name,version,status,update
If WP-CLI is not available, open Plugins in the WordPress admin and read the version under the plugin name. Compare it with the affected range above. A deactivated plugin is lower risk than an active one, but it still sits on disk, so remove it if you do not use it.
This plugin only matters on sites that run BuddyPress and let members post activity updates with links. If you do not use the activity stream, the plugin may be safe to remove.
What to do now
- Update Activity Link Preview For BuddyPress to 1.6.0 or later. With WP-CLI that is
wp plugin update activity-link-preview-for-buddypress. - Take a backup first if the site is busy, and test the update on a staging copy when you can.
- If you do not use the plugin, deactivate and delete it.
- If your server can reach internal services, such as a metadata endpoint or an admin panel on a private network, review outbound firewall rules so the web server cannot reach what it does not need.
- Review your plugin list for anything else that is out of date. Old plugins are where most WordPress incidents begin.
- Turn on automatic updates for plugins you trust, or add a regular review to your calendar.
If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.
Why it matters
This is CWE-918, server side request forgery. A link preview feature fetches a page so it can show a title and image. If the address is not checked, a visitor can aim that fetch at places the server can reach but the visitor cannot, such as internal hosts.
The defense is a short list of allowed schemes and hosts, a block on private address ranges, and no following of redirects to blocked places. Network rules around the web server add a second layer.
WordPress plugins run with the same trust as the rest of the site. A weakness in one small add on is a weakness in the whole install, and plugin flaws are easy to find at scale because the code is public and the plugin slugs are predictable.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What fixes CVE-2025-47548?
Patchstack lists Activity Link Preview For BuddyPress 1.6.0 as patched. Update to 1.6.0 or later.
Why would a link preview be risky?
Because the server itself makes the request. If the target address is not restricted, it can be pointed at internal systems.
Sources
Last reviewed: 18 October 2026.
