CVE-2026-13700: WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

Q: What is the severity of CVE-2026-13700?

The severity of CVE-2026-13700 is rated at 71, indicating a medium to high risk level.

Q: How do I fix CVE-2026-13700?

To fix CVE-2026-13700, upgrade the WooMS plugin to a version above 9.14 that includes the necessary validation fixes.

Q: What type of vulnerability is CVE-2026-13700?

CVE-2026-13700 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability.

Q: What are the consequences of exploiting CVE-2026-13700?

Exploiting CVE-2026-13700 allows unauthenticated attackers to perform server-side request forgery and potentially disclose sensitive integration credentials.

Q: Which versions of the WooMS plugin are affected by CVE-2026-13700?

CVE-2026-13700 affects WooMS plugin versions up to and including 9.14.

Published Aug 17, 2026

Updated

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

Affected Software

1 affected component

WordPress WooMS Plugin<=9.14

Event History

Aug 17, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2026-13700?

The severity of CVE-2026-13700 is rated at 71, indicating a medium to high risk level.

How do I fix CVE-2026-13700?

To fix CVE-2026-13700, upgrade the WooMS plugin to a version above 9.14 that includes the necessary validation fixes.

What type of vulnerability is CVE-2026-13700?

CVE-2026-13700 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability.

What are the consequences of exploiting CVE-2026-13700?

Exploiting CVE-2026-13700 allows unauthenticated attackers to perform server-side request forgery and potentially disclose sensitive integration credentials.

Which versions of the WooMS plugin are affected by CVE-2026-13700?

CVE-2026-13700 affects WooMS plugin versions up to and including 9.14.

CVE-2026-13700: WooMS <= 9.14 - Unauthenticated Server-Side Request Forgery and Sensitive Information Disclosure

Affected Software

Event History

Don't miss critical vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2026-13700?

How do I fix CVE-2026-13700?

What type of vulnerability is CVE-2026-13700?

What are the consequences of exploiting CVE-2026-13700?

Which versions of the WooMS plugin are affected by CVE-2026-13700?

Company

Resources

Contact

Frequently Asked Questions

What is the severity of CVE-2026-13700?

How do I fix CVE-2026-13700?

What type of vulnerability is CVE-2026-13700?

What are the consequences of exploiting CVE-2026-13700?

Which versions of the WooMS plugin are affected by CVE-2026-13700?