CVE-2025-10705: MxChat – AI Chatbot for WordPress <= 2.4.6 - Unauthenticated Blind Server-Side Request Forgery
The MxChat – AI Chatbot for WordPress plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 2.4.6. This is due to insufficient validation of user-supplied URLs in the PDF processing functionality. This makes it possible for unauthenticated attackers to make the WordPress server perform HTTP requests to arbitrary destinations via the mxchathandlechatrequest AJAX action.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10705?
CVE-2025-10705 is classified as a Medium severity vulnerability due to its potential for exploitation via Blind Server-Side Request Forgery.
How do I fix CVE-2025-10705?
To fix CVE-2025-10705, upgrade the MxChat – AI Chatbot for WordPress plugin to version 2.4.7 or later.
What systems are affected by CVE-2025-10705?
CVE-2025-10705 affects all versions of the MxChat – AI Chatbot for WordPress plugin up to and including version 2.4.6.
What is the attack vector for CVE-2025-10705?
The attack vector for CVE-2025-10705 involves insufficient validation of user-supplied URLs in the PDF processing functionality.
Can CVE-2025-10705 lead to unauthorized access?
Yes, CVE-2025-10705 can potentially allow unauthorized remote actions due to its exploitation capabilities.