WooMS <= 9.14 Unauthenticated SSRF and Sensitive Information Disclosure (CVE-2026-13700)

Vulnerability Overview Vulnerability Name: WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure Description: The plugin does not validate user-supplied URLs before using them for server-side requests, appending stored third-party integration credentials to each request. This allows unauthorized attackers to perform Server-Side Request Forgery (SSRF) and leak configured integration credentials when relevant data synchronization features are enabled. CVE ID: CVE-2026-13700 Classification: - Type: SSRF - OWASP Top 10: A1: Injection - CWE: CWE-918 - CVSS Score: 5.9 (medium) Affected Versions Affected Plugin: WooMS Known Fixes: No known fixes Remediation PoC Code: Proof-of-concept code will be released on August 28, 2026, to give users time to update. Additional Information Original Researcher: dangnosuy Submitter: dangnosuy Submitter Website: https://vncsglobal.vn/ Verification Status: Yes WPVDB ID: dd9e51a2-43fb-46de-8e59-2d9611fcc4ff Timeline Public Release Date: 2026-08-14 Date Added: 2026-08-07 Last Updated: 2026-08-07 Related Vulnerabilities 2024-06-20: BlossomThemes Email Newsletter < 2.2.7 - Authenticated (Admin+) Server-Side Request Forgery 2021-04-13: WP-DownloadManager < 1.68.5 - Server-Side Request Forgery (SSRF) 2025-09-22: Skimlinks Affiliate Marketing Tool <= 1.3 - Authenticated (Administrator+) Server-Side Request Forgery 2025-06-19: WPThumb <= 0.10 - Authenticated (Contributor+) Server-Side Request Forgery 2024-07-22: AI Engine < 2.4.8 - Authenticated (Subscriber+) Server-Side Request Forgery Summary This vulnerability involves an unauthenticated Server-Side Request Forgery (SSRF) and sensitive information disclosure in the WooMS plugin. Due to the lack of validation on user-supplied URLs, attackers can exploit this issue to perform SSRF and leak integration credentials. There are currently no known fixes available. PoC code will be released on August 28, 2026. Users are advised to monitor official updates and take security measures promptly.

Goal Reached Thanks to every supporter — we hit 100%!

WooMS <= 9.14 Unauthenticated SSRF and Sensitive Information Disclosure (CVE-2026-13700)