The vulnerability CVE-2025-10735 affects the 'Block For Mailchimp – Add Email Subscription Forms and Collect Leads' WordPress plugin, allowing unauthenticated attackers to exploit a Blind SSRF flaw through the mcbSubmit_Form_Data() function. This flaw permits the attacker to induce the server to send HTTP requests to arbitrary locations, which may include internal network services. The vulnerability is present in all versions up to and including 1.1.12. The CVSS v3.1 base score is 4.0, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to integrity loss without confidentiality or availability impact. No patch or vendor advisory confirming remediation is currently available.

An attacker can leverage this SSRF vulnerability to make the server send requests to arbitrary URLs, potentially accessing or modifying internal services that are not directly accessible externally. This can lead to unauthorized information modification within internal systems. However, the vulnerability does not impact confidentiality or availability directly. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the vulnerable plugin or restricting access to the affected functionality to trusted users only. Monitor vendor channels for updates and apply patches promptly once available.