Description

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-08-17T06:17:31.120Z",
  "pubdate": "2026-08-17T06:17:31.120Z",
  "executiveSummary": "The WooMS WordPress plugin through version 9.14 suffers from a Server-Side Request Forgery (SSRF) vulnerability coupled with sensitive credential disclosure. This security flaw originates from the plugin's failure to adequately validate user-supplied URLs prior to processing them within server-side HTTP requests. When the relevant data-sync feature is enabled, the affected application automatically appends stored third-party integration credentials to every outgoing request triggered through this mechanism.\nThe impact of this vulnerability is critical, as it enables unauthenticated remote attackers to coerce the vulnerable server into initiating arbitrary network connections toward internal or external resources. Furthermore, the inadvertent leakage of third-party integration credentials exposes connected external services to compromise. The risk implications include unauthorized access to internal network infrastructure that is otherwise shielded from the public internet, potential data exfiltration, and the exposure of sensitive API keys or authentication tokens associated with the third-party integrations.\nExploitation of this vulnerability requires no authentication or special privileges, lowering the barrier to entry for malicious actors. Attackers must rely on the activation of the relevant data-sync feature within the target installation to successfully exfiltrate the integrated credentials via the SSRF channel.",
  "technicalDetails": "The root cause of the vulnerability resides in insufficient input validation and sanitization within the WooMS WordPress plugin through version 9.14. Specifically, the component responsible for handling user-supplied URLs fails to implement strict allowlisting or proper parsing checks before passing the input to HTTP request execution functions. As a result, the server processes arbitrary destination URLs specified by the caller.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the vulnerable endpoint exposed by the WooMS plugin, supplying a malicious or arbitrary URL via the parameter processed by the insecure request handler. Because the application lacks proper URL validation, it initiates a server-side request to the attacker-controlled destination or an internal network resource. Simultaneously, the application logic automatically attaches stored third-party integration credentials to the headers or parameters of the outgoing request whenever the relevant data-sync feature is enabled.\nNetwork exposure is inherent to the web application hosting the vulnerable WordPress plugin, allowing any remote network attacker to interact with the vulnerable endpoint without prior authentication. The payload behavior involves the transmission of sensitive integration credentials directly to the endpoint specified by the attacker during the SSRF execution.\nThe post-exploitation impact includes unauthorized interaction with internal services (such as internal APIs, metadata services, or databases) via the SSRF vector, as well as the immediate disclosure of sensitive third-party integration credentials captured by the attacker via their listening server. This exposes both the hosting infrastructure and connected third-party platforms to subsequent unauthorized access and compromise."
}