Server-Side Request Forgery Vulnerability in ThemesInflow Hercules Core by ThemesInflow
CVE-2025-63010

4.8MEDIUM

Key Information:

Vendor

WordPress
Status
Hercules Core
Vendor
CVE Published:
9 December 2025

What is CVE-2025-63010?

A Server-Side Request Forgery (SSRF) vulnerability exists in the ThemesInflow Hercules Core plugin, which could allow attackers to send unauthorized requests from the vulnerable server to internal or external resources. This flaw may lead to data leaks or unauthorized access to sensitive information within the network. It affects Hercules Core versions from n/a through 7.4, making it crucial for users of this plugin to apply security patches to prevent exploitation.

Affected Version(s)

Hercules Core <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/herc...
vdb-entry

CVSS V3.1

Score:
4.8
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Bonds | Patchstack Bug Bounty Program
JSON
.