WordPress Plugin Vulnerabilities

WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

Description

The plugin does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

Proof of Concept

Affects Plugins

Plugin icon
wooms
No known fix

References

CVE
CVE-2026-13700

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
5.9 (medium)

Miscellaneous

Original Researcher
dangnosuy
Submitter
dangnosuy
Submitter website
https://vncsglobal.vn/
Verified
Yes
WPVDB ID
dd9e51a2-43fb-46de-8e59-2d9611fcc4ff

Timeline

Publicly Published
2026-08-14 (about 2 days ago)
Added
2026-08-07 (about 9 days ago)
Last Updated
2026-08-07 (about 9 days ago)

Other

Published
Title
Published
2025-03-04
Title
Downloable by American Osteopathic Association <= 0.1.0 - Unauthenticated SSRF
Published
2025-07-03
Title
Allmart <= 1.0.0 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2024-06-27
Title
Foxiz < 2.3.6 - Unauthenticated Server-Side Request Forgery
Published
2025-03-21
Title
Export and Import Users and Customers < 2.6.3 - Authenticated (Administrator+) Server-Side Request Forgery via validate_file Function
Published
2025-03-21
Title
Make Builder < 1.1.11 - Authenticated (Subscriber+) Server-Side Request Forgery via make_builder_ajax_subscribe Function