EUVD-2025-209108
GHSA-x7f7-7836-w8h5
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
3Description
The Oxygen Theme theme for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.0.8 via the laborator_calc_route AJAX action. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Analysis
Server-Side Request Forgery (SSRF) in Oxygen Theme for WordPress versions up to 6.0.8 allows unauthenticated remote attackers to make arbitrary HTTP requests from the web server via the vulnerable laborator_calc_route AJAX action. This vulnerability is confirmed exploitable without authentication (CVSS PR:N) and enables attackers to query or modify internal services behind firewalls, exfiltrate cloud metadata (AWS/Azure credentials), or scan internal networks. No public exploit identified at time of analysis, though the unauthenticated attack vector and low complexity (AC:L) suggest straightforward exploitation.
Technical Context
This vulnerability affects the Oxygen Theme (cpe:2.3:a:laborator:oxygen_-_woocommerce_wordpress_theme), a commercial WooCommerce-focused WordPress theme developed by Laborator. The flaw resides in the laborator_calc_route AJAX action handler, which fails to properly validate or restrict the destination of server-initiated HTTP requests. SSRF vulnerabilities (CWE-918) occur when an application accepts user-controlled URLs without adequate validation, allowing attackers to abuse the server as a proxy to access resources that should be protected by network segmentation or firewall rules. WordPress AJAX actions registered without proper capability checks or nonce validation are accessible to unauthenticated users via admin-ajax.php endpoints. The CVSS scope change (S:C) indicates the vulnerability can affect resources beyond the vulnerable WordPress installation itself, such as internal services accessible from the web server's network position.
Affected Products
This vulnerability affects all versions of the Oxygen - WooCommerce WordPress Theme (developed by Laborator) up to and including version 6.0.8. The affected product is identified by CPE string cpe:2.3:a:laborator:oxygen_-_woocommerce_wordpress_theme:*:*:*:*:*:*:*:*. Oxygen is a premium commercial theme designed for WordPress WooCommerce installations, available through ThemeForest and the vendor's direct sales channels. Site administrators can verify their installation version through the WordPress admin panel under Appearance > Themes. The vendor's complete advisory and release notes are available at https://documentation.laborator.co/kb/oxygen/oxygen-release-notes/.
Remediation
Site administrators should immediately upgrade to Oxygen Theme version 6.0.9 or later, which addresses this SSRF vulnerability according to the vendor's release notes at https://documentation.laborator.co/kb/oxygen/oxygen-release-notes/. For premium theme updates, log into your ThemeForest account or Laborator customer portal, download the latest version, and install via WordPress admin panel (Appearance > Themes > Add New > Upload Theme) or via FTP by replacing the theme directory. Before updating, create a full site backup including database and theme files. If immediate patching is not feasible, implement temporary network-level controls by restricting outbound connections from the web server to only necessary external services, blocking access to internal IP ranges (RFC 1918: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and cloud metadata endpoints (169.254.169.254). Web Application Firewall (WAF) rules blocking requests to admin-ajax.php with action parameter 'laborator_calc_route' can provide defense-in-depth but should not replace vendor patching. Detailed technical analysis is available at https://www.wordfence.com/threat-intel/vulnerabilities/id/8c83f430-8a4d-40fa-890c-387c787a3b55?source=cve.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today