PT-2025-39515 · WordPress · Snow Monkey

Yuya Kotake · Published 2025-09-26 · Updated 2025-09-26 · CVE-2025-10137

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snow Monkey versions prior to 29.1.6

Description The Snow Monkey theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 29.1.5. This flaw resides within the request() function and allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Successful exploitation could enable attackers to query and modify information from internal services.

Recommendations Update to Snow Monkey version 29.1.6 or later.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10137

Affected Products

Snow Monkey

References · 10

• https://osv.dev/vulnerability/CVE-2025-10137 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10137 · Security Note
• https://github.com/inc2734/snow-monkey/compare/29.1.5...29.1.6 · Note
• https://github.com/inc2734/wp-oembed-blog-card/blob/master/src/App/Model/Requester.php#L64-L89 · Note
• https://github.com/inc2734/wp-oembed-blog-card/compare/14.0.1...14.0.2 · Note
• https://github.com/inc2734/wp-oembed-blog-card · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=cve · Note
• https://t.me/cveNotify/136502 · Telegram Post
• https://t.me/CVEtracker/33427 · Telegram Post
• https://twitter.com/CVEnew/status/1971467045012197826 · Twitter Post