CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2w_get_urls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
The Amazon Products to WooCommerce plugin versions 1.2.7 and earlier contain a server-side request forgery vulnerability. An unauthenticated attacker can make the site send HTTP requests to internal or external systems on the attacker's behalf. This could expose internal services, retrieve sensitive data, or interact with third-party APIs without authorization.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs controlled by the attacker.
Potential impact on your site
Attackers can probe your internal network, access internal services, or abuse your site to attack other systems.
Conditions required to exploit
No authentication or user interaction required; attacker needs only network access to the site.
Key dates
External resources
Related vulnerabilities
