CVE-2026-13700

This SSRF vulnerability in WooMS carries significantly more risk than its CVSS 5.9 suggests. The plugin's data-sync feature automatically retrieves stored third-party integration credentials and attaches them to every outbound request. When you exploit the SSRF to redirect that request, those credentials come straight to you. There's no additional reconnaissance, no credential store to find, no chaining required. This fundamentally changes the vulnerability's nature. Standard SSRF lets attackers probe internal services for reconnaissance—this one hands them the keys to whatever systems WooMS integrates with. Based on the WooMS naming convention, these are likely inventory, supplier, or logistics platforms where API privileges tend to be elevated (write access, not just read). The blast radius of compromise isn't 'attacker gets WordPress admin'—it's 'attacker gets the keys to the operational systems WordPress was mediating.' That potentially includes supply chain access across B2B relationships. The conditional enablement—data-sync must be active—creates a critical detection gap. During scheduled sync cycles, the plugin is expected to make outbound requests to third-party systems. The SSRF attack blends into legitimate traffic precisely when credential exfiltration is active. Standard monitoring assumes attack surfaces are relatively static; this one opens and closes based on sync schedules. Automated scanners may miss it if they check while sync is disabled, and defenders investigating a breach won't see 'SSRF attack' in their SIEM—they'll see their plugin making what looks like a legitimate API call. The EPSS low score likely reflects that this specific plugin combination isn't yet in automated tooling, not that exploitation is unlikely. Once public, opportunistic scans can immediately leverage the credential exfiltration pathway with zero additional sophistication. Combined with the fact that integration credentials in sync workflows tend to rotate infrequently (rotation breaks scheduled syncs), the exposure window extends well beyond just 'time unpatched.' Prioritize patching WooMS installations with data-sync enabled. Treat any successful SSRF exploitation against this plugin as a potential credential compromise requiring full integration credential rotation—not just a technical vulnerability closure.

Reviewed through automated stages and approved by a human before publication.