The Oxygen theme for WordPress is vulnerable to Server‑Side Request Forgery in all versions up to and including 6.0.8. The flaw resides in the laborator_calc_route AJAX action, which allows an attacker to issue arbitrary HTTP requests from the application. By exploiting this, a malicious actor can retrieve or alter data from internal network services, potentially exposing sensitive information or manipulating internal systems. This weakness matches CWE‑918.

The affected products are the Laborator Oxygen WooCommerce WordPress Theme, all releases through version 6.0.8. Sites that have not upgraded beyond this point are susceptible. No additional vendor or product variants are listed.

The vulnerability scores 7.2 on the CVSS scale, indicating a high impact potential. No EPSS score is available and it is not listed in the CISA KEV catalog, but the lack of authentication required and the ability to reach internal resources make exploitation attractive. Attackers can trigger the SSRF through unauthenticated POST requests to the endpoint, with no additional conditions reported.