CVE-2025-10735: Block For Mailchimp – Easy Mailchimp Form Integration <= 1.1.12 - Unauthenticated Blind Server-Side Request Forgery
The Block For Mailchimp – Easy Mailchimp Form Integration plugin for WordPress is vulnerable to Blind Server-Side Request Forgery in all versions up to, and including, 1.1.12 via the mcbSubmitFormData(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10735?
CVE-2025-10735 is categorized as a medium severity vulnerability due to its potential impact on the site's security.
How do I fix CVE-2025-10735?
To mitigate CVE-2025-10735, update the Block For Mailchimp – Easy Mailchimp Form Integration plugin to the latest version.
Who is affected by CVE-2025-10735?
CVE-2025-10735 affects all versions of the Block For Mailchimp – Easy Mailchimp Form Integration plugin up to and including 1.1.12.
What type of vulnerability is CVE-2025-10735?
CVE-2025-10735 is identified as a Blind Server-Side Request Forgery (SSRF) vulnerability.
Can unauthenticated attackers exploit CVE-2025-10735?
Yes, unauthenticated attackers can exploit CVE-2025-10735 to make web requests to internal or external resources.