CVE-2025-10874: 
WordPress vulnerability analysis and mitigation

The Orbit Fox WordPress plugin (versions before 3.0.2) contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2025-10874. The vulnerability exists in the stock photo import feature, which fails to properly limit URLs that can be specified by users. The plugin is also known as 'Orbit Fox: Duplicate Page, Menu Icons, SVG Support, Cookie Notice, Custom Fonts & More' (AttackerKB).

The vulnerability has been assigned a CVSS v3.1 base score of 5.5 (Medium), with an impact score of 2.7 and exploitability score of 2.3. The attack vector is Network-based, with low attack complexity but requires high privileges and no user interaction. The scope is changed, with low impact on both confidentiality and integrity, and no impact on availability (AttackerKB).

When exploited, this vulnerability allows an authenticated user to force the server to make requests to arbitrary URLs of their choosing, potentially leading to unauthorized access to internal resources or services (WPScan).

The vulnerability has been patched in Orbit Fox version 3.0.2. Users are advised to update to this version or later to mitigate the risk (WPScan).