CVE-2025-63010: 
WordPress vulnerability analysis and mitigation

CVE-2025-63010 is a Server-Side Request Forgery (SSRF) vulnerability in the ThemesInflow Hercules Core WordPress plugin, affecting all versions up to and including 7.4. The vulnerability was reported by researcher "Bonds" on September 21, 2025, and published by Patchstack on October 21, 2025. It carries a CVSS v3.1 base score of 4.9 (Medium), requiring low privileges and high attack complexity (Patchstack).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery) and allows an authenticated attacker with at least Subscriber-level privileges to cause the WordPress server to issue HTTP requests to arbitrary domains controlled by the attacker. Exploitation requires high attack complexity and network-level access, but no user interaction. The changed scope indicator in the CVSS vector reflects that the impact extends beyond the vulnerable component itself, potentially reaching internal services or infrastructure not directly exposed to the internet (Patchstack).

Successful exploitation could allow an attacker to probe internal network services, enumerate sensitive metadata (e.g., cloud instance metadata endpoints), or access resources on internal systems that are otherwise inaccessible from the internet. The CVSS assessment indicates low confidentiality and low integrity impact with no availability impact, and the changed scope means the effect can extend to systems beyond the WordPress installation itself. This makes the vulnerability particularly relevant in cloud-hosted environments where internal services may be reachable from the web server (Patchstack).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.027%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires an authenticated account with at least Subscriber-level privileges, which limits the attacker pool but does not eliminate risk on sites with open registration (Patchstack).

As of the time of disclosure, no official patch has been released by ThemesInflow for the Hercules Core plugin. Patchstack recommends updating the plugin as the primary remediation step; if an update is unavailable, site administrators should contact their hosting provider or web developer for assistance. As a workaround, administrators can restrict plugin functionality, disable the affected plugin entirely, or use a web application firewall (WAF) with SSRF-specific rules to block malicious outbound requests. Limiting outbound HTTP requests from the web server at the network level (egress filtering) can also reduce the risk of exploitation (Patchstack).