Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins
Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Montonio for WooCommerce
Vendor
Montonio
Product
Montonio for WooCommerce
Platforms
Unknown
Default status
unaffected
Package
montonio-for-woocommerce
Package collection
https://wordpress.org/plugins
Montonio for WooCommerce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
6.0.1
6.0.2 → unaffected
Wpopal Core Features
Vendor
Wpopal
Product
Wpopal Core Features
Platforms
Unknown
Default status
unaffected
Package
wpopal-core-features
Package collection
https://wordpress.org/plugins
Wpopal Core Features · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
1.5.8
None listed
ArcStone
Vendor
AMO for WP – Membership Management
Product
ArcStone
Platforms
Unknown
Default status
unaffected
Package
wp-amo
Package collection
https://wordpress.org/plugins
ArcStone · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
4.6.6
None listed
WooVirtualWallet – A virtual wallet for WooCommerce
Vendor
Long Watch Studio
Product
WooVirtualWallet – A virtual wallet for WooCommerce
Platforms
Unknown
Default status
unaffected
Package
woovirtualwallet
Package collection
https://wordpress.org/plugins
WooVirtualWallet – A virtual wallet for WooCommerce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
2.2.1
None listed
WooVIP – Membership plugin for WordPress and WooCommerce
Vendor
Long Watch Studio
Product
WooVIP – Membership plugin for WordPress and WooCommerce
Platforms
Unknown
Default status
unaffected
Package
woovip
Package collection
https://wordpress.org/plugins
WooVIP – Membership plugin for WordPress and WooCommerce · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
1.4.4
None listed
WooSupply – Suppliers, Supply Orders and Stock Management
Vendor
Long Watch Studio
Product
WooSupply – Suppliers, Supply Orders and Stock Management
Platforms
Unknown
Default status
unaffected
Package
woosupply
Package collection
https://wordpress.org/plugins
WooSupply – Suppliers, Supply Orders and Stock Management · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
1.2.2
None listed
Theme Minifier
Vendor
Squidesma
Product
Theme Minifier
Platforms
Unknown
Default status
unaffected
Package
theme-minifier
Package collection
https://wordpress.org/plugins
Theme Minifier · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
2.0
None listed
Styles
Vendor
Paul Clark
Product
Styles
Platforms
Unknown
Default status
unaffected
Package
styles
Package collection
https://wordpress.org/plugins
Styles · Scoped product and version facts
Version (version)
Status (status)
Version scheme (versionType)
Exclusive end (lessThan)
Inclusive end (lessThanOrEqual)
Status changes (at → status)
n/a
affected
custom
Unavailable
1.2.3
None listed
WordPress Page Builder – Qards
Vendor
Designmodo Inc.
Product
WordPress Page Builder – Qards
Platforms
Unknown
Default status
unaffected
Package
qards-free
Package collection
https://wordpress.org/plugins
WordPress Page Builder – Qards · Scoped product and version facts