PT-2025-42646 · WordPress · Orbit Fox

Ryan Roth · Published 2025-10-17 · Updated 2025-10-24 · CVE-2025-10874

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin versions prior to 3.0.2

Description The plugin does not properly restrict URLs used in the stock photo import feature, allowing a user to specify arbitrary URLs. This can lead to a server-side request forgery (SSRF), enabling an attacker to force the server to access any URL they choose. A null byte truncation bypasses validation, potentially exposing AWS metadata and credentials.

Recommendations Update The Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More WordPress plugin to version 3.0.2 or later.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-10874

Affected Products

Orbit Fox

References · 7

• 🔥 https://wpscan.com/vulnerability/171ba43f-55b6-471d-af0a-be553baf639a · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-10874 · Security Note
• https://twitter.com/f1rstm4tter/status/1979193225454752021 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1981617530004279544 · Twitter Post
• https://t.me/cveNotify/140127 · Telegram Post
• https://twitter.com/CVEnew/status/1981607292848992328 · Twitter Post
• https://t.me/CVEtracker/35638 · Telegram Post