CVE-2022-40700 Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins
Attackers can exploit SSRF in multiple WordPress plugins to access internal resources or bypass security controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-40700?
CVE-2022-40700 is a high-severity server-side request forgery vulnerability in AMO for WP – Membership Management AMP Toolbox, published on 19 Jan 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
Weakness: CWE-918
Which versions are affected by CVE-2022-40700?
It affects 15 products.
Products include Agence-Press Css Adder, Arcstone Amo for Wp - Membership Management, Deano Amp Toolbox, Designmodo Qards, Frumph Phpfreechat, Longwatchstudio Woosupply and 9 more.
How do I fix CVE-2022-40700?
No fix has been published for CVE-2022-40700 yet. Limit exposure of the affected software until one is available.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2022-40700 being exploited?
There is no known exploitation of CVE-2022-40700 in the wild and no public exploit code.
Sources
Also known as GHSA-3mv9-fmvf-xvmx.