9.8

CVE-2022-40700

Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins

CSSTidy - Server-Side Request Forgery

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
Mögliche Gegenmaßnahme
Admin CSS MU: Update to version 2.7, or a newer patched version
AMP Toolbox: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Confirm Data: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
CSS Adder By Agence-Press: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Custom Login Admin Front-end CSS: Update to version 1.5, or a newer patched version
phpfreechat: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
WordPress Page Builder – Qards: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Styles: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Theme Minifier: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
WooSupply – Suppliers, Supply Orders and Stock Management: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
WooVIP – Membership plugin for WordPress and WooCommerce: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
WooVirtualWallet – A virtual wallet for WooCommerce: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
AMO for WP – Membership Management: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Wpopal Core Features: No known patch available. Please review the vulnerability's details in depth and employ mitigations based on your organization's risk tolerance. It may be best to uninstall the affected software and find a replacement.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Millionclues ≫ Admin Css Mu SwPlatform wordpress Version <= 2.6
Deano ≫ Amp Toolbox SwPlatform wordpress Version <= 2.1.1
Unihost ≫ Confirm Data SwPlatform wordpress Version <= 1.0.7
Agence-press ≫ Css Adder SwPlatform wordpress Version <= 1.5.0
Millionclues ≫ Custom Login Admin Front-end Css SwPlatform wordpress Version <= 1.4.1
Montonio ≫ Montonio For Woocommerce SwPlatform wordpress Version <= 6.0.1
Frumph ≫ Phpfreechat SwPlatform wordpress Version <= 0.2.8
Designmodo ≫ Qards SwPlatform wordpress Version <= 1.0.5
Paulclark ≫ Styles SwPlatform wordpress Version <= 1.2.3
Squidesma ≫ Theme Minifier SwPlatform wordpress Version <= 2.0
Longwatchstudio ≫ Woosupply SwPlatform wordpress Version <= 1.2.2
Longwatchstudio ≫ Woovip SwPlatform wordpress Version <= 1.4.4
Longwatchstudio ≫ Woovirtualwallet SwPlatform wordpress Version <= 2.2.1
Arcstone ≫ Amo For Wp - Membership Management SwPlatform wordpress Version <= 4.6.6
Wpopal ≫ Wpopal Core Features SwPlatform wordpress Version <= 1.5.8
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Admin CSS MU
Version *-2.6
SystemWordPress Plugin
≫
Produkt AMP Toolbox
Version *-2.1.1
SystemWordPress Plugin
≫
Produkt Confirm Data
Version *-1.0.7
SystemWordPress Plugin
≫
Produkt CSS Adder By Agence-Press
Version *-1.5.0
SystemWordPress Plugin
≫
Produkt Custom Login Admin Front-end CSS
Version *-1.4.1
SystemWordPress Plugin
≫
Produkt phpfreechat
Version *-2.0.8
SystemWordPress Plugin
≫
Produkt WordPress Page Builder – Qards
Version *-1.0.5
SystemWordPress Plugin
≫
Produkt Styles
Version *-1.2.3
SystemWordPress Plugin
≫
Produkt Theme Minifier
Version *-2.0
SystemWordPress Plugin
≫
Produkt WooSupply – Suppliers, Supply Orders and Stock Management
Version *-1.2.2.
SystemWordPress Plugin
≫
Produkt WooVIP – Membership plugin for WordPress and WooCommerce
Version *-1.4.4
SystemWordPress Plugin
≫
Produkt WooVirtualWallet – A virtual wallet for WooCommerce
Version *-2.2.1
SystemWordPress Plugin
≫
Produkt AMO for WP – Membership Management
Version *-4.6.6
SystemWordPress Plugin
≫
Produkt Wpopal Core Features
Version *-1.5.7
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1% 0.582
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
audit@patchstack.com 8.2 3.9 4.2
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CWE-918 Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpress-custom-login-admin-front-end-css-plugin-1-4-1-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plugin-6-0-1-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/qards-free/wordpress-wordpress-page-builder-qards-plugin-1-0-5-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/woosupply/wordpress-woosupply-plugin-1-2-2-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/woovip/wordpress-woovip-plugin-1-4-4-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7-server-side-request-forgery-ssrf?_s_id=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/fb534d86-c477-4a9c-b048-2fbc002168b2
Third Party Advisory