The Printful Integration for WooCommerce plugin contains a Server‑Side Request Forgery flaw located in the advanced size chart REST API endpoint. Insufficient validation of user‑supplied URLs before passing them to the download_url() function allows an attacker to cause the server to request arbitrary URLs. The resulting request can retrieve or alter data from external or internal services, leading to information disclosure or modification of privileged resources.

Any site running Printful Integration for WooCommerce up to and including version 2.2.11 is affected. The vulnerability is exploitable by users with Contributor level or higher access, meaning it primarily impacts authenticated users who can submit requests through the REST API.

The CVSS score of 6.4 indicates a moderate severity once authenticated. The EPSS score of less than 1% denotes a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog, but the required authentication and contributor permission mean the attack surface is limited to sites with a broader set of users. An attacker could potentially extract internal data or modify state within the WordPress environment if they obtain contributor access.