The WooMS WordPress plugin fails to validate user‑supplied URLs used in a server‑side request and automatically attaches stored third‑party integration credentials to each outgoing request. An unauthenticated attacker can submit any URL, forcing the server to resolve it and fetch arbitrary resources. When the data‑synchronization feature is active, the intercepted requests expose the configured integration credentials. This combination allows both exploitation of internal infrastructure and unauthorized disclosure of sensitive secrets.

All versions of the WooMS WordPress plugin through 9.14 are affected. No information indicates that later releases contain a fix.

The vulnerability is unauthenticated, allowing any web visitor to initiate a request to an arbitrary URL from the host. Because no credentials are required to trigger the request, attackers can target internal services that are normally inaccessible from the outside. The CVSS score of 5.9 and an EPSS score < 1% place the vulnerability in the moderate risk range, and the very low but non‑zero likelihood of exploitation is reflected by the EPSS figure, while the failure to validate URLs combined with credential leakage suggests a high‑severity risk. The feature is not listed in the CISA KEV catalog, but the potential for credential theft remains a significant threat.