CVE-2025-10705: MxChat AI Chatbot SSRF Vulnerability

CVE-2025-10705 Overview

CVE-2025-10705 is a Blind Server-Side Request Forgery (SSRF) vulnerability affecting the MxChat – AI Chatbot for WordPress plugin. The flaw exists in all versions up to and including 2.4.6. It stems from insufficient validation of user-supplied URLs within the plugin's PDF processing functionality. Unauthenticated attackers can abuse the mxchat_handle_chat_request AJAX action to force the WordPress server to issue HTTP requests to arbitrary destinations. The vulnerability is categorized under CWE-918 (Server-Side Request Forgery).

Critical Impact
Unauthenticated attackers can coerce vulnerable WordPress servers into making outbound HTTP requests to attacker-chosen destinations, enabling internal network reconnaissance and interaction with internal services.

Affected Products

MxChat – AI Chatbot for WordPress plugin (mxchat-basic)
All versions up to and including 2.4.6
WordPress installations with the plugin activated

Discovery Timeline

2025-10-23 - CVE CVE-2025-10705 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-10705

Vulnerability Analysis

The MxChat plugin exposes an AJAX endpoint named mxchat_handle_chat_request that accepts URL parameters intended for PDF document ingestion. The plugin fetches remote URLs supplied by the client so the chatbot can process document contents. The endpoint does not authenticate the caller and does not validate that the target URL points to an approved external resource. This design permits an attacker to submit any URL, including those referencing internal IP ranges, loopback addresses, or cloud metadata endpoints.

Because the SSRF is blind, the HTTP response body is not returned directly to the attacker. However, attackers can still infer information through side channels such as response timing, error messages, and observable side effects on internal services. The affected code paths reside in class-mxchat-integrator.php around lines 1090, 1108, and 2360, as referenced in the WordPress plugin source.

Root Cause

The root cause is missing URL validation and allow-listing in the PDF ingestion routine. User-supplied URLs are passed to a server-side HTTP client without checks against private IP ranges, link-local addresses, or restricted schemes. The endpoint also lacks capability and nonce checks, exposing the functionality to unauthenticated requests.

Attack Vector

An attacker sends a crafted HTTP POST request to the WordPress admin-ajax.php endpoint invoking the mxchat_handle_chat_request action with a URL parameter pointing to an internal target. The WordPress server dispatches the outbound request on the attacker's behalf. Targets of interest include 127.0.0.1, RFC1918 addresses, and cloud metadata services such as 169.254.169.254. Refer to the Wordfence advisory for additional context.

Detection Methods for CVE-2025-10705

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing the action=mxchat_handle_chat_request parameter from unauthenticated sources.
Outbound HTTP requests from the WordPress host to internal IP ranges, 127.0.0.1, or 169.254.169.254.
Web server access logs showing repeated calls to the MxChat AJAX action with varying URL parameters.
Unexpected DNS lookups originating from the WordPress server to attacker-controlled domains.

Detection Strategies

Inspect WordPress access logs for the mxchat_handle_chat_request action combined with URL parameters referencing non-public destinations.
Correlate egress traffic from web servers against expected destinations to identify SSRF attempts to internal services.
Deploy a web application firewall rule that flags requests to the MxChat AJAX action containing URLs targeting private address space.

Monitoring Recommendations

Monitor outbound connections from WordPress hosts to cloud metadata endpoints and internal management interfaces.
Alert on spikes in unauthenticated POST requests to admin-ajax.php referencing the MxChat action.
Track DNS query patterns from the PHP process for uncommon external domains or DNS exfiltration markers.

How to Mitigate CVE-2025-10705

Immediate Actions Required

Update the MxChat – AI Chatbot for WordPress plugin to a version newer than 2.4.6 that contains the fix from changeset 3378505.
Deactivate and remove the plugin if a patched version is not available for your deployment.
Restrict outbound network access from WordPress hosts to only required destinations.

Patch Information

The vendor addressed the vulnerability in a release following version 2.4.6. Review the WordPress plugin changeset 3378505 for the code changes that introduce URL validation in the PDF processing path. Confirm the installed version through the WordPress admin plugins screen after updating.

Workarounds

Block the mxchat_handle_chat_request AJAX action at the web application firewall until the plugin is updated.
Configure egress firewall rules that deny WordPress server connections to RFC1918 ranges, loopback, and 169.254.169.254.
Require authentication in front of admin-ajax.php for administrative environments where feasible.

bash

# Example nginx egress restriction and WAF block for the vulnerable action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "mxchat_handle_chat_request") {
        return 403;
    }
    include fastcgi_params;
    fastcgi_pass unix:/var/run/php-fpm.sock;
}