Executive brief
WooMS is a WordPress plugin that syncs e-commerce data with MoySklad, a third-party inventory management service. The plugin fails to validate URLs before making backend requests and exposes stored MoySklad credentials in those requests, allowing attackers to intercept those credentials and redirect requests to attacker-controlled servers or internal systems without any authentication required.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) combined with sensitive information disclosure in the WooMS WordPress plugin. The plugin's REST API endpoint /wp-json/wooms/v1/order-update/ accepts user-supplied URLs without validation and uses them in server-side requests while automatically attaching stored MoySklad Basic authentication credentials. An unauthenticated attacker can POST a specially crafted JSON payload containing an arbitrary URL to trigger an outbound request from the WordPress server, which exposes the Base64-encoded MoySklad credentials in the Authorization header. This affects all installations with the data-sync feature enabled. No patch has been announced as of the advisory date.
Affected products
- WooMS WooMS through 9.14
Timeline
- 2026-08-14: disclosed
- 2026-08-17: advisory