Server-Side Request Forgery in ZoloBlocks by bdthemes
CVE-2025-60161

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Zoloblocks
Vendor
CVE Published:
26 September 2025

What is CVE-2025-60161?

ZoloBlocks, a product by bdthemes, is vulnerable to a Server-Side Request Forgery (SSRF) attack. This flaw allows an attacker to send tailored HTTP requests from the server, potentially exposing sensitive information or executing unauthorized actions. The vulnerability affects all versions of ZoloBlocks from n/a to 2.3.9, necessitating prompt action to mitigate risks associated with internal service access and data leakage.

Affected Version(s)

ZoloBlocks <= 2.3.9

References

https://patchstack.com/database/wordpress/plugin/zolobloc...
vdb-entry

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Yudha - DJ (Patchstack Alliance)
JSON
.
CVE-2025-60161 : Server-Side Request Forgery in ZoloBlocks by bdthemes