CVE-2025-10705 is a Blind SSRF vulnerability in the MxChat – AI Chatbot & Content Generation for WordPress plugin, affecting all versions up to 2.4.6. The issue stems from insufficient validation of URLs provided by users in the plugin's PDF processing functionality. Exploitation allows unauthenticated attackers to leverage the mxchat_handle_chat_request AJAX action to cause the WordPress server to perform HTTP requests to arbitrary external or internal network resources. This vulnerability does not require user interaction or privileges and has a medium impact on confidentiality but no impact on integrity or availability.

An attacker can cause the vulnerable WordPress server to initiate HTTP requests to arbitrary destinations, potentially exposing internal network resources or sensitive information accessible via these requests. The impact is limited to partial confidentiality loss (information disclosure) without affecting data integrity or service availability. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or restricting access to the PDF processing functionality or the mxchat_handle_chat_request AJAX action to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.