Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00733.

Exploitation none

Automatable yes

Technical Impact total

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Montonio Montonio for WooCommerce unaffected
Version Status Constraints
n/a affected ≤ 6.0.1
Wpopal Wpopal Core Features unaffected
Version Status Constraints
n/a affected ≤ 1.5.8
AMO for WP – Membership Management ArcStone unaffected
Version Status Constraints
n/a affected ≤ 4.6.6
Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce unaffected
Version Status Constraints
n/a affected ≤ 2.2.1
Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce unaffected
Version Status Constraints
n/a affected ≤ 1.4.4
Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management unaffected
Version Status Constraints
n/a affected ≤ 1.2.2
Squidesma Theme Minifier unaffected
Version Status Constraints
n/a affected ≤ 2.0
Paul Clark Styles unaffected
Version Status Constraints
n/a affected ≤ 1.2.3
Designmodo Inc. WordPress Page Builder – Qards unaffected
Version Status Constraints
n/a affected ≤ 1.0.5
Philip M. Hofer (Frumph) PHPFreeChat unaffected
Version Status Constraints
n/a affected ≤ 0.2.8
Arun Basil Lal Custom Login Admin Front-end CSS unaffected
Version Status Constraints
n/a affected ≤ 1.4.1
Team Agence-Press CSS Adder By Agence-Press unaffected
Version Status Constraints
n/a affected ≤ 1.5.0
Unihost Confirm Data unaffected
Version Status Constraints
n/a affected ≤ 1.0.7
deano1987 AMP Toolbox unaffected
Version Status Constraints
n/a affected ≤ 2.1.1
Arun Basil Lal Admin CSS MU unaffected
Version Status Constraints
n/a affected ≤ 2.6

Configuration 1 [-]

cpe:2.3:a:millionclues:admin_css_mu:*:*:*:*:*:wordpress:*:*

Configuration 2 [-]

cpe:2.3:a:deano:amp_toolbox:*:*:*:*:*:wordpress:*:*

Configuration 3 [-]

cpe:2.3:a:unihost:confirm_data:*:*:*:*:*:wordpress:*:*

Configuration 4 [-]

cpe:2.3:a:agence-press:css_adder:*:*:*:*:*:wordpress:*:*

Configuration 5 [-]

cpe:2.3:a:millionclues:custom_login_admin_front-end_css:*:*:*:*:*:wordpress:*:*

Configuration 6 [-]

cpe:2.3:a:montonio:montonio_for_woocommerce:*:*:*:*:*:wordpress:*:*

Configuration 7 [-]

cpe:2.3:a:frumph:phpfreechat:*:*:*:*:*:wordpress:*:*

Configuration 8 [-]

cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:*

Configuration 9 [-]

cpe:2.3:a:paulclark:styles:*:*:*:*:*:wordpress:*:*

Configuration 10 [-]

cpe:2.3:a:squidesma:theme_minifier:*:*:*:*:*:wordpress:*:*

Configuration 11 [-]

OR cpe:2.3:a:longwatchstudio:woosupply:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:longwatchstudio:woovip:*:*:*:*:*:wordpress:*:*
cpe:2.3:a:longwatchstudio:woovirtualwallet:*:*:*:*:*:wordpress:*:*

Configuration 12 [-]

cpe:2.3:a:arcstone:amo_for_wp_-_membership_management:*:*:*:*:*:wordpress:*:*

Configuration 13 [-]

cpe:2.3:a:wpopal:wpopal_core_features:*:*:*:*:*:wordpress:*:*

No data.

No data.

Project Subscriptions

Vendors Products
Agence-press Subscribe
Css Adder Subscribe
Arcstone Subscribe
Amo For Wp - Membership Management Subscribe
Deano Subscribe
Amp Toolbox Subscribe
Designmodo Subscribe
Qards Subscribe
Frumph Subscribe
Phpfreechat Subscribe
Longwatchstudio Subscribe
Woosupply Subscribe
Woovip Subscribe
Woovirtualwallet Subscribe
Millionclues Subscribe
Admin Css Mu Subscribe
Custom Login Admin Front-end Css Subscribe
Montonio Subscribe
Montonio For Woocommerce Subscribe
Paulclark Subscribe
Styles Subscribe
Squidesma Subscribe
Theme Minifier Subscribe
Unihost Subscribe
Confirm Data Subscribe
Wpopal Subscribe
Wpopal Core Features Subscribe
Advisories
Source ID Title
EUVD EUVD EUVD-2022-43971 Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
Fixes

Solution

Update Montonio for WooCommerce to 6.0.2 or a higher version. Update Custom Login Admin Front-end CSS to 1.5 or a higher version. Update Admin CSS MU to 2.7 or a higher version

Workaround

No workaround given by the vendor.

References
Link Providers
https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpress-custom-login-admin-front-end-css-plugin-1-4-1-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plugin-6-0-1-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/qards-free/wordpress-wordpress-page-builder-qards-plugin-1-0-5-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/woosupply/wordpress-woosupply-plugin-1-2-2-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/woovip/wordpress-woovip-plugin-1-4-4-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7-server-side-request-forgery-ssrf?_s_id=cve cve-icon cve-icon
History

Wed, 13 Nov 2024 18:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2024-11-13T17:40:07.080Z

Reserved: 2022-09-27T08:42:32.033Z

Link: CVE-2022-40700

cve-icon Vulnrichment

Updated: 2024-08-03T12:21:46.616Z

cve-icon NVD

Status : Modified

Published: 2024-01-19T15:15:08.020

Modified: 2024-11-21T07:21:53.063

Link: CVE-2022-40700

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses