PT-2025-39515 · WordPress · Snow Monkey

Yuya Kotake · CVE-2025-10137 · Published 2025-09-26 · Updated 2025-09-26

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Snow Monkey versions prior to 29.1.6

Description The Snow Monkey theme for WordPress is susceptible to Server-Side Request Forgery (SSRF) in all versions up to and including 29.1.5. This flaw resides within the request() function and allows unauthenticated attackers to initiate web requests to arbitrary locations from the web application. Successful exploitation could enable attackers to query and modify information from internal services.

Recommendations Update to Snow Monkey version 29.1.6 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10137

Affected Products

Snow Monkey

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/10xxx/CVE-2025-10137.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10137 · Security Note
• https://osv.dev/vulnerability/CVE-2025-10137 · Vendor Advisory
• https://github.com/inc2734/snow-monkey/compare/29.1.5...29.1.6 · Note
• https://github.com/inc2734/wp-oembed-blog-card/blob/master/src/App/Model/Requester.php#L64-L89 · Note
• https://github.com/inc2734/wp-oembed-blog-card · Note
• https://github.com/inc2734/wp-oembed-blog-card/compare/14.0.1...14.0.2 · Note
• https://t.me/CVEtracker/33427 · Telegram Post
• https://twitter.com/CVEnew/status/1971467045012197826 · Twitter Post
• https://t.me/cveNotify/136502 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=cve · Note