CVE-2026-13700 WooMS CVE debrief

Who should care

WordPress administrators and users of the WooMS plugin should review and update their installations to prevent potential SSRF attacks. Affected operators include those with exposure to the WooMS plugin, particularly in environments where data-sync features are enabled. Vulnerability management and security teams should prioritize reviewing and mitigating this vulnerability due to its potential impact on server-side request forgery and credential disclosure.

Technical summary

The WooMS WordPress plugin through 9.14 does not validate user-supplied URLs before using them in server-side requests, allowing unauthenticated attackers to perform Server-Side Request Forgery (SSRF) and disclose configured integration credentials when the data-sync feature is enabled. This vulnerability has a CVSS score of 5.9 and a severity of MEDIUM. Affected product context includes WordPress administrators and users of the WooMS plugin. Defensive impact involves reviewing and updating the plugin to version 9.15 or later, implementing compensating controls, and monitoring for suspicious requests.

Defensive priority

Medium-priority defensive review recommended due to potential SSRF vulnerability.

Recommended defensive actions

• Review and update WooMS WordPress plugin to version 9.15 or later
• Implement compensating controls to detect and prevent SSRF attacks
• Monitor for suspicious server-side requests
• Verify integration credentials are not exposed
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed

Evidence notes

Evidence from WPScan indicates potential Server-Side Request Forgery (SSRF) vulnerability in WooMS WordPress plugin. Official CVE and NVD records provide additional context. The vulnerability allows unauthenticated attackers to perform SSRF and disclose configured integration credentials when the data-sync feature is enabled. Defenders should verify affected product deployments, review official advisories, and plan vendor-supported updates or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.