Executive brief
The WordPress & WooCommerce Scraper plugin allows website administrators to import product and content data from external websites. A server-side request forgery (SSRF) vulnerability enables unauthenticated attackers to make the server initiate requests to internal systems and services, potentially exposing sensitive data or allowing lateral movement within a network infrastructure behind the firewall.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) in the WordPress & WooCommerce Scraper plugin (wp_scraper) versions up to 1.0.7. The plugin fails to properly validate or restrict server-side HTTP requests made during the data scraping functionality, allowing an unauthenticated attacker to supply arbitrary URLs that the server will fetch on their behalf. This permits attackers to access internal systems, services, and APIs that should not be directly reachable from the internet, potentially leaking sensitive information from behind firewall protections. No official patch is currently available; affected users should update or disable the plugin pending a fix.
Affected products
- extendons WordPress & WooCommerce Scraper (wp_scraper) <= 1.0.7
Timeline
- 2025-10-19: disclosed: Reported to Patchstack
- 2025-12-31: advisory: Published by Patchstack