CVE-2025-10735

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-10735", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-19T15:00:10.416Z", "datePublished": "2025-10-01T03:25:23.454Z", "dateUpdated": "2026-04-08T16:52:39.004Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:39.004Z"}, "affected": [{"vendor": "bplugins", "product": "Block for Mailchimp \u2013 Add Email Subscription Forms and Collect Leads", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.1.12", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Block For Mailchimp \u2013 Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Block For Mailchimp \u2013 Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=cve"}, {"url": "https://plugins.svn.wordpress.org/block-for-mailchimp/tags/1.1.9/mailchimp/API.php"}, {"url": "https://wordpress.org/plugins/block-for-mailchimp/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368808%40block-for-mailchimp&new=3368808%40block-for-mailchimp&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "baseScore": 4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "D01EXPLOIT OFFICIAL"}], "timeline": [{"time": "2025-09-19T15:15:24.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-30T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-01T15:00:20.268498Z", "id": "CVE-2025-10735", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:00:41.816Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-10735", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-01T15:00:20.268498Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-01T15:00:38.570Z"}}], "cna": {"title": "Block For Mailchimp \u2013 Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "D01EXPLOIT OFFICIAL"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"}}], "affected": [{"vendor": "bplugins", "product": "Block for Mailchimp \u2013 Add Email Subscription Forms and Collect Leads", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.1.12"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-19T15:15:24.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-30T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=cve"}, {"url": "https://plugins.svn.wordpress.org/block-for-mailchimp/tags/1.1.9/mailchimp/API.php"}, {"url": "https://wordpress.org/plugins/block-for-mailchimp/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368808%40block-for-mailchimp&new=3368808%40block-for-mailchimp&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Block For Mailchimp \u2013 Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:39.004Z"}}}, "cveMetadata": {"cveId": "CVE-2025-10735", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:39.004Z", "dateReserved": "2025-09-19T15:00:10.416Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-01T03:25:23.454Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Block for Mailchimp \u2013 Add Email Subscription Forms and Collect Leads", "vendor": "bplugins", "versions": [{"lessThanOrEqual": "1.1.12", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Block For Mailchimp \u2013 Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmit_Form_Data(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Block For Mailchimp - Easy Mailchimp Form Integration para WordPress es vulnerable a falsificaci\u00f3n de petici\u00f3n del lado del servidor ciega en todas las versiones hasta la 1.1.12, inclusive, a trav\u00e9s de mcbSubmit_Form_Data(). Esto permite a atacantes no autenticados realizar peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-10735", "lastModified": "2026-10-09T09:10:00.213", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.0, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 1.4, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-10735", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-01T15:00:20.268498Z", "version": "2.0.3"}}]}, "published": "2025-10-01T04:15:59.680", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/block-for-mailchimp/tags/1.1.9/mailchimp/API.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3368808%40block-for-mailchimp&new=3368808%40block-for-mailchimp&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/block-for-mailchimp/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/51de575f-d458-4a7d-bc57-4a11e5124377?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:15:11.023767+00:00", "value": {"mitigation_remediation": ["Upgrade the Block for Mailchimp plugin to the latest version available from the official WordPress plugin repository or from the vendor.", "If an update is not available, uninstall or disable the plugin to eliminate the SSRF vulnerability.", "Restrict inbound traffic to the plugin\u2019s form endpoints using a firewall or web application firewall, blocking requests that attempt to reach internal network ranges."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery allowing unauthenticated requests to arbitrary internal URLs"}, "threat_synthesis": {"affected_systems": "All WordPress sites that run the Block for Mailchimp \u2013 Add Email Subscription Forms and Collect Leads plugin version 1.1.12 or earlier are affected.", "description_and_impact": "The vulnerability is in the mcbSubmit_Form_Data() routine of the Block for Mailchimp plugin for WordPress. It allows unauthenticated attackers to cause the application to send HTTP requests to any URL specified in the request, including internal service endpoints. Because the responses are not returned to the attacker, this is a blind SSRF. The potential impact is that the attacker can query or change information on internal services that the WordPress site can reach.", "risk_and_exploitability": "The CVSS score of 4 indicates a medium baseline risk. The EPSS score of less than 1% indicates exploitation is uncommon. The vulnerability is not listed in CISA\u2019s KEV catalog. Attackers only need to submit a crafted form to trigger the SSRF, which can be done from any remote location. The impact is limited to server\u2011side requests; because no data is returned, no direct exfiltration is possible, but the ability to reach internal services could be leveraged within environments where the network is poorly segmented."}}}}, "created": "2025-10-02T08:46:05.787118+00:00", "updated": "2026-04-22T14:15:20.429111+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}