The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body. Rated low severity (CVSS 2.7), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
SSRF
WordPress
Mailchimp For Woocommerce
NVD
WPScan
CVSS 3.1
2.7
EPSS
0.6%