BaseFortify

Publication date: 2025-10-24

Last updated on: 2025-10-27

Assigner: WPScan

Description

The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin before 3.0.2 does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-10-24

Last Modified

2025-10-27

Generated

2026-07-06

AI Q&A

2025-10-24

EPSS Evaluated

2026-07-05

NVD

CVE-2025-10874

Affected Vendors & Products

Vendor	Product	Version / Range
wp_themes	orbit_fox	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Orbit Fox WordPress plugin before version 3.0.2. It does not restrict the URLs that can be used in its stock photo import feature, allowing an attacker to specify arbitrary URLs. This results in a server-side request forgery (SSRF), where the attacker can make the server access any URL they choose.

Impact Analysis

The vulnerability can allow an attacker to make the server perform unauthorized requests to internal or external systems. This can lead to information disclosure, unauthorized access to internal services, or other malicious activities depending on what URLs the attacker forces the server to access.

Hi! I’m here to help you understand CVE-2025-10874. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70