CVE-2026-13700
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.
Risk Assessment
An attacker can use the server to send requests to internal resources, potentially leading to disclosure of sensitive data or access to internal systems. Additionally, integration credentials may leak.
Recommendation
Update the WooMS plugin to the latest version once the vendor releases a fix. Disable the data-sync feature if not essential and restrict access to it.
Original NVD description (English source)
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.