Wooms
Monthly
Server-Side Request Forgery in the WooMS WordPress plugin through version 9.14 allows unauthenticated remote attackers to trigger outbound HTTP requests to arbitrary URLs from the server, with third-party integration credentials automatically appended to each request. The vulnerability is conditional on the data-sync feature being enabled. A publicly available exploit exists per WPScan reporting, and successful exploitation results in full disclosure of stored integration credentials, making the confidentiality impact high despite a moderate aggregate CVSS score.
Server-Side Request Forgery in the WooMS WordPress plugin through version 9.14 allows unauthenticated remote attackers to trigger outbound HTTP requests to arbitrary URLs from the server, with third-party integration credentials automatically appended to each request. The vulnerability is conditional on the data-sync feature being enabled. A publicly available exploit exists per WPScan reporting, and successful exploitation results in full disclosure of stored integration credentials, making the confidentiality impact high despite a moderate aggregate CVSS score.