UNKNOWN NVD

CVE-2026-13700

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integrati

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

References

https://wpscan.com/vulnerability/dd9e51a2-43fb-46de-8e59-2d9611fcc4ff/

Published: 2026-08-17 · Source: NVD · Feed updated: 2026-08-17

This unknown severity vulnerability was published on 2026-08-17 via NVD.

vulnfeed aggregates 11808 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.