The Amazon Products to WooCommerce WordPress plugin is vulnerable to a server‑side request forgery (CWE‑918) in all releases through 1.2.7. The flaw is triggered via the wcta2w_get_urls() function, which processes user‑supplied URLs without proper validation. An unauthenticated attacker can use this to cause the server to fetch any target host, including internal network services, thereby exposing or altering sensitive data. This can compromise confidentiality, integrity, and availability of internal systems.

WordPress sites that have the Amazon Products to WooCommerce plugin installed from the vendor suhailahmad64, in any version up to and including 1.2.7. The vulnerability is specific to that plugin and does not affect core WordPress or other plugins.

The CVSS score of 7.2 indicates high severity, while the EPSS score of less than 1% shows a very low current exploitation probability; the vulnerability is not flagged in the CISA KEV catalog. Attack requires no special credentials or privileged access—it exploits an unauthenticated endpoint that can be queried by any external user. Consequently, a remote attacker can trigger the plugin to reach arbitrary URLs from the server, facilitating attacks such as internal port scanning, data exfiltration, or altering internal service state. The lack of network segmentation or firewall restrictions ups the risk of internal resource exposure.