Vulnerabilities CVE-2026-13700

CVE-2026-13700

None

Open

TLP:CLEAR

WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

NVD CVE.org

AI Analysis

No AI analysis yet.

Description

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

Details

Confidence: 90%
Published: Aug 17, 2026
Last Modified: Aug 17, 2026

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.