WordPress Plugin Vulnerabilities

Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery

Description

The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affects Plugins

Plugin icon
import-products-to-wc
No known fix

References

CVE
CVE-2025-5817
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5055cf24-14c7-4533-8900-a5f4c1435201

Classification

Type
SSRF
OWASP top 10
A1: Injection
CWE
CWE-918
CVSS
7.2 (high)

Miscellaneous

Original Researcher
ch4r0n
Verified
No
WPVDB ID
e4336f17-2325-4403-ad01-3c0c637bb012

Timeline

Publicly Published
2025-07-01 (about 9 months ago)
Added
2025-07-01 (about 9 months ago)
Last Updated
2025-07-02 (about 9 months ago)

Other

Published
Title
Published
2016-04-12
Title
WordPress <= 4.4.2 - SSRF Bypass using Octal & Hexedecimal IP addresses
Published
2024-11-01
Title
Magical Addons For Elementor < 1.2.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2013-06-21
Title
WordPress 3.5-3.5.1 HTTP API Unspecified Server Side Request Forgery (SSRF)
Published
2025-10-24
Title
Slider Templates <= 1.0.3 - Authenticated (Subscriber+) Server-Side Request Forgery
Published
2026-04-01
Title
Webmention < 5.7.0 - Unauthenticated Blind Server-Side Request Forgery