CVE-2025-62741: 
WordPress vulnerability analysis and mitigation

CVE-2025-62741 is a Server-Side Request Forgery (SSRF) vulnerability in the SmartDataSoft Pool Services WordPress theme, affecting all versions through 3.3. It was discovered by Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) on October 28, 2025, reported to Patchstack on November 27, 2025, and published to the NVD on January 22, 2026. The CNA (Patchstack) assigned a CVSS v3.1 score of 5.4 (Medium), while CISA-ADP initially scored it 9.1 (Critical) before that score was removed following Patchstack's revised assessment (Patchstack, NVD).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and resides in the SmartDataSoft Pool Services WordPress theme (versions ≤ 3.3). An unauthenticated remote attacker can craft malicious requests that cause the server to issue HTTP requests to arbitrary domains or internal resources controlled by the attacker, bypassing network access controls. No authentication or user interaction is required for exploitation, and the attack is conducted entirely over the network (Patchstack, NVD).

Successful exploitation allows an attacker to make the vulnerable WordPress server issue requests to arbitrary internal or external domains, potentially exposing sensitive information from internal services (e.g., cloud metadata endpoints, internal APIs), bypassing firewall controls, and performing actions on behalf of the server. The Patchstack advisory notes this could enable discovery of sensitive information from other services running on the same system. Confidentiality and integrity are the primary concerns, with no direct availability impact (Patchstack).

No public proof-of-concept exploit code has been published, and there is no evidence of active in-the-wild exploitation as of the latest available data. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies this as low priority, noting it is unlikely to be exploited despite the potential for use in mass-exploit campaigns targeting WordPress themes (Patchstack, NVD).

As of the latest available data, no official patch has been released for the Pool Services WordPress theme by SmartDataSoft. Site administrators should consider deactivating and removing the theme until a patched version is available. In the interim, implementing Web Application Firewall (WAF) rules to detect and block SSRF attempts (e.g., blocking requests to internal IP ranges such as 169.254.169.254, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) is recommended. Network segmentation to restrict outbound HTTP requests from the WordPress server can further reduce exposure (Patchstack).