CVE-2022-2267

The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example

Score
CVSS 3.1 4.3 Medium
Status
Modified - contact@wpscan.com
Published
2022-08-29
Last modified
2024-08-03
Weaknesses
CWE-918

Affected products

References

 
 
© AVABIS GmbH privacypolicy about