PT-2025-39515 · WordPress · Snow Monkey

Yuya Kotake · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10137

Positive Technologies · (AI Summary)

CVSS v3.1

5.4

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

**Name of the Vulnerable Software and Affected Versions**

Snow Monkey versions prior to 29.1.6

**Description**

The Snow Monkey theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 29.1.5. This flaw resides within the `request()` function and allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Successful exploitation could enable attackers to query and modify information from internal services.

**Recommendations**

Update to Snow Monkey version 29.1.6 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10137

Affected Products

Snow Monkey

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-10137 · Security Note
• https://github.com/inc2734/snow-monkey/compare/29.1.5...29.1.6 · Note
• https://github.com/inc2734/wp-oembed-blog-card/compare/14.0.1...14.0.2 · Note
• https://github.com/inc2734/wp-oembed-blog-card/blob/master/src/App/Model/Requester.php#L64-L89 · Note
• https://github.com/inc2734/wp-oembed-blog-card · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=cve · Note
• https://twitter.com/CVEnew/status/1971467045012197826 · Twitter Post