Orbit Fox CVE-2025-10874

Requires an authenticated WordPress session with access to the Orbit Fox 'stock photo import' feature on a site running the plugin before version 3.0.2; the import URL field is not restricted (no allow-list/validation), so the attacker simply enters an arbitrary internal or external URL for the server to fetch. Limiting factors: authentication is required (vendor rates it PR:H, i.e. high-privilege account), no unauthenticated path exists, and impact is bounded (CVSS C:L/I:L, no availability impact) - the server performs the request but the flaw does not itself grant code execution or full data disclosure. Verify whether lower roles (author/editor) can reach the feature, which would widen exploitability.

This is a genuine but low-priority SSRF (CWE-918) rated CVSS 5.5 (Medium). The signals are consistent and point to limited real-world risk: EPSS is 0.19% (8th percentile), there is no CISA KEV listing and no public exploit code identified, giving 'no public exploit identified at time of analysis.' The CVSS vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N shows a network-reachable, low-complexity flaw but gated behind PR:H (high-privilege authenticated access), which sharply reduces the attacker population - an attacker already holding elevated WordPress privileges is required. The scope change (S:C) and C:L/I:L reflect that the SSRF can pivot the server to reach internal/cloud resources, but impacts are rated Low, not full compromise. One point to verify: the vector asserts PR:H, yet the stock-photo import is typically a content-authoring feature often available to lower-privileged roles (author/editor), so the true privilege bar may be PR:L - this would modestly raise exploitability and should be confirmed against the plugin's capability checks. No KEV + very low EPSS + authentication requirement together indicate this is a routine patch-on-cycle item, not an emergency.

An authenticated WordPress user with access to the Orbit Fox stock-photo import feature supplies a crafted URL (e.g. a cloud metadata endpoint like 169.254.169.254 or an internal service) instead of a legitimate image source. The plugin's server fetches that URL, letting the attacker probe internal networks, reach non-internet-exposed services, or retrieve limited internal responses. No public proof-of-concept is identified at time of analysis.