CVE-2025-5817: Amazon Products to WooCommerce <= 1.2.7 - Unauthenticated Server-Side Request Forgery
The Amazon Products to WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 1.2.7 via the wcta2wgeturls(). This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5817?
CVE-2025-5817 has a medium severity rating due to its potential for exposing sensitive data through Server-Side Request Forgery.
How do I fix CVE-2025-5817?
To fix CVE-2025-5817, upgrade the Amazon Products to WooCommerce plugin to version 1.2.8 or later.
Who is affected by CVE-2025-5817?
All users of the Amazon Products to WooCommerce plugin for WordPress versions up to and including 1.2.7 are affected by CVE-2025-5817.
What type of vulnerability is CVE-2025-5817?
CVE-2025-5817 is classified as a Server-Side Request Forgery (SSRF) vulnerability.
Can unauthenticated attackers exploit CVE-2025-5817?
Yes, unauthenticated attackers can exploit CVE-2025-5817 to make web requests to arbitrary locations.