---
id: CVE-2025-10137
title: >-
  The Snow Monkey theme for WordPress is vulnerable to Server-Side Request
  Forgery in all versions up to, and including, 29.1.5 via the request()
  function
summary: >-
  The Snow Monkey theme for WordPress is vulnerable to Server-Side Request
  Forgery in all versions up to, and including, 29.1.5 via the request()
  function. This makes it possible for unauthenticated attackers to make web
  requests to arbitr…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'
cwe:
  - CWE-918
published: '2025-09-26'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T20:10:00.200'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2025-10137'
references:
  - url: 'https://github.com/inc2734/snow-monkey/compare/29.1.5...29.1.6'
    label: security@wordfence.com
  - url: 'https://github.com/inc2734/wp-oembed-blog-card'
    label: security@wordfence.com
  - url: >-
      https://github.com/inc2734/wp-oembed-blog-card/blob/master/src/App/Model/Requester.php#L64-L89
    label: security@wordfence.com
  - url: 'https://github.com/inc2734/wp-oembed-blog-card/compare/14.0.1...14.0.2'
    label: security@wordfence.com
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/3d4a938a-044b-4991-bc4c-db9e15210f06?source=cve
    label: security@wordfence.com
tags:
  - nvd
epss: 0.00276
epssPercentile: 0.18483
ingestedAt: '2026-10-12T14:50:34.004Z'
---

## Overview

The Snow Monkey theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 29.1.5 via the request() function. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.