CVE-2025-68500: 
WordPress vulnerability analysis and mitigation

CVE-2025-68500 is a Server-Side Request Forgery (SSRF) vulnerability in the Prime Slider – Addons For Elementor WordPress plugin developed by bdthemes. It affects all versions up to and including 4.0.10, and was reported by researcher NumeX on November 13, 2025, with public disclosure on December 13, 2025. The vulnerability was assigned a CVSS v3.1 base score of 4.9 (Medium) (Patchstack).

The vulnerability is classified as CWE-918 (Server-Side Request Forgery), where insufficient validation of user-supplied URL or network-related inputs allows an authenticated attacker (with at minimum Subscriber-level privileges) to cause the server to issue HTTP requests to arbitrary domains or internal network addresses. Exploitation requires low privileges and high attack complexity, but no user interaction, and the scope is changed — meaning the impact can extend beyond the vulnerable component itself. No public proof-of-concept or detailed technical write-up has been published at this time (Patchstack).

Successful exploitation could allow an attacker to cause the WordPress server to make requests to internal network resources not directly accessible from the internet, potentially exposing sensitive information from internal services or APIs. The vulnerability carries low confidentiality and low integrity impact, with no availability impact, limiting its severity compared to unauthenticated SSRF variants. It could be leveraged to bypass network segmentation or probe internal infrastructure, though the high attack complexity and required authentication reduce the practical risk (Patchstack).

There is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation at this time. The EPSS score is approximately 0.03%, reflecting a very low probability of exploitation in the near term. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes the vulnerability has low priority and is unlikely to be exploited (Patchstack).

The vulnerability is patched in Prime Slider – Addons For Elementor version 4.1.0; users should update immediately via the WordPress plugin dashboard. If an immediate update is not possible, restrict Subscriber-level user registrations, implement network-level egress filtering to block unauthorized outbound server requests, and configure a Web Application Firewall (WAF) to detect and block SSRF patterns. Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically (Patchstack).

The vulnerability received limited community attention, with brief mentions on social platforms including Mastodon and Bluesky by security news aggregators such as TheHackerWire. Wordfence included it in their weekly WordPress vulnerability report for the week of December 8–14, 2025. No significant vendor statements or notable researcher commentary beyond the Patchstack disclosure have been identified.