Server Side Request Forgery (SSRF) vulnerability affecting multiple WordPress plugins
Priority MEDIUM 51CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00999 62nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Montonio | Montonio for WooCommerce | up to 6.0.1 | — | No fix listed | CNA |
| wpopal | Wpopal Core Features | up to 1.5.8 | — | No fix listed | CNA |
| AMO for WP – Membership Management | ArcStone | up to 4.6.6 | — | No fix listed | CNA |
| Long Watch Studio | WooVirtualWallet – A virtual wallet for WooCommerce | up to 2.2.1 | — | No fix listed | CNA |
| Long Watch Studio | WooVIP – Membership plugin for WordPress and WooCommerce | up to 1.4.4 | — | No fix listed | CNA |
| Long Watch Studio | WooSupply – Suppliers, Supply Orders and Stock Management | up to 1.2.2 | — | No fix listed | CNA |
| Squidesma | Theme Minifier | up to 2.0 | — | No fix listed | CNA |
| Paul Clark | Styles | up to 1.2.3 | — | No fix listed | CNA |
| Designmodo Inc. | WordPress Page Builder – Qards | up to 1.0.5 | — | No fix listed | CNA |
| Philip M. Hofer (Frumph) | PHPFreeChat | up to 0.2.8 | — | No fix listed | CNA |
| arunbasillal | Custom Login Admin Front-end CSS | up to 1.4.1 | — | No fix listed | CNA |
| Team Agence-Press | CSS Adder By Agence-Press | up to 1.5.0 | — | No fix listed | CNA |
| Unihost | Confirm Data | up to 1.0.7 | — | No fix listed | CNA |
| deano1987 | AMP Toolbox | up to 2.1.1 | — | No fix listed | CNA |
| arunbasillal | Admin CSS MU | up to 2.6 | — | No fix listed | CNA |
- Montonio for WooCommerce VendorMontonio Affected up to 6.0.1 Fixed in — No fix listed CNA
- Wpopal Core Features Vendorwpopal Affected up to 1.5.8 Fixed in — No fix listed CNA
- ArcStone VendorAMO for WP – Membership Management Affected up to 4.6.6 Fixed in — No fix listed CNA
- WooVirtualWallet – A virtual wallet for WooCommerce VendorLong Watch Studio Affected up to 2.2.1 Fixed in — No fix listed CNA
- WooVIP – Membership plugin for WordPress and WooCommerce VendorLong Watch Studio Affected up to 1.4.4 Fixed in — No fix listed CNA
- WooSupply – Suppliers, Supply Orders and Stock Management VendorLong Watch Studio Affected up to 1.2.2 Fixed in — No fix listed CNA
- Theme Minifier VendorSquidesma Affected up to 2.0 Fixed in — No fix listed CNA
- Styles VendorPaul Clark Affected up to 1.2.3 Fixed in — No fix listed CNA
- WordPress Page Builder – Qards VendorDesignmodo Inc. Affected up to 1.0.5 Fixed in — No fix listed CNA
- PHPFreeChat VendorPhilip M. Hofer (Frumph) Affected up to 0.2.8 Fixed in — No fix listed CNA
- Custom Login Admin Front-end CSS Vendorarunbasillal Affected up to 1.4.1 Fixed in — No fix listed CNA
- CSS Adder By Agence-Press VendorTeam Agence-Press Affected up to 1.5.0 Fixed in — No fix listed CNA
- Confirm Data VendorUnihost Affected up to 1.0.7 Fixed in — No fix listed CNA
- AMP Toolbox Vendordeano1987 Affected up to 2.1.1 Fixed in — No fix listed CNA
- Admin CSS MU Vendorarunbasillal Affected up to 2.6 Fixed in — No fix listed CNA
CPE configurations NVD · 15
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:millionclues:admin_css_mu:*:*:*:*:*:wordpress:*:* | up to 2.6 | Vulnerable | Millionclues |
| cpe:2.3:a:deano:amp_toolbox:*:*:*:*:*:wordpress:*:* | up to 2.1.1 | Vulnerable | Deano |
| cpe:2.3:a:unihost:confirm_data:*:*:*:*:*:wordpress:*:* | up to 1.0.7 | Vulnerable | Unihost |
| cpe:2.3:a:agence-press:css_adder:*:*:*:*:*:wordpress:*:* | up to 1.5.0 | Vulnerable | Agence-press |
| cpe:2.3:a:millionclues:custom_login_admin_front-end_css:*:*:*:*:*:wordpress:*:* | up to 1.4.1 | Vulnerable | Millionclues |
| cpe:2.3:a:montonio:montonio_for_woocommerce:*:*:*:*:*:wordpress:*:* | up to 6.0.1 | Vulnerable | Montonio |
| cpe:2.3:a:frumph:phpfreechat:*:*:*:*:*:wordpress:*:* | up to 0.2.8 | Vulnerable | Frumph |
| cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:* | up to 1.0.5 | Vulnerable | Designmodo Inc. |
| cpe:2.3:a:paulclark:styles:*:*:*:*:*:wordpress:*:* | up to 1.2.3 | Vulnerable | Paul Clark |
| cpe:2.3:a:squidesma:theme_minifier:*:*:*:*:*:wordpress:*:* | up to 2.0 | Vulnerable | Squidesma |
- cpe:2.3:a:millionclues:admin_css_mu:*:*:*:*:*:wordpress:*:* Versions up to 2.6 Vulnerable ·Millionclues
- cpe:2.3:a:deano:amp_toolbox:*:*:*:*:*:wordpress:*:* Versions up to 2.1.1 Vulnerable ·Deano
- cpe:2.3:a:unihost:confirm_data:*:*:*:*:*:wordpress:*:* Versions up to 1.0.7 Vulnerable ·Unihost
- cpe:2.3:a:agence-press:css_adder:*:*:*:*:*:wordpress:*:* Versions up to 1.5.0 Vulnerable ·Agence-press
- cpe:2.3:a:millionclues:custom_login_admin_front-end_css:*:*:*:*:*:wordpress:*:* Versions up to 1.4.1 Vulnerable ·Millionclues
- cpe:2.3:a:montonio:montonio_for_woocommerce:*:*:*:*:*:wordpress:*:* Versions up to 6.0.1 Vulnerable ·Montonio
- cpe:2.3:a:frumph:phpfreechat:*:*:*:*:*:wordpress:*:* Versions up to 0.2.8 Vulnerable ·Frumph
- cpe:2.3:a:designmodo:qards:*:*:*:*:*:wordpress:*:* Versions up to 1.0.5 Vulnerable ·Designmodo Inc.
- cpe:2.3:a:paulclark:styles:*:*:*:*:*:wordpress:*:* Versions up to 1.2.3 Vulnerable ·Paul Clark
- cpe:2.3:a:squidesma:theme_minifier:*:*:*:*:*:wordpress:*:* Versions up to 2.0 Vulnerable ·Squidesma
Show 5 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:longwatchstudio:woosupply:*:*:*:*:*:wordpress:*:* | up to 1.2.2 | Vulnerable | Long Watch Studio |
| cpe:2.3:a:longwatchstudio:woovip:*:*:*:*:*:wordpress:*:* | up to 1.4.4 | Vulnerable | Long Watch Studio |
| cpe:2.3:a:longwatchstudio:woovirtualwallet:*:*:*:*:*:wordpress:*:* | up to 2.2.1 | Vulnerable | Long Watch Studio |
| cpe:2.3:a:arcstone:amo_for_wp_-_membership_management:*:*:*:*:*:wordpress:*:* | up to 4.6.6 | Vulnerable | Arcstone |
| cpe:2.3:a:wpopal:wpopal_core_features:*:*:*:*:*:wordpress:*:* | up to 1.5.8 | Vulnerable | wpopal |
- cpe:2.3:a:longwatchstudio:woosupply:*:*:*:*:*:wordpress:*:* Versions up to 1.2.2 Vulnerable ·Long Watch Studio
- cpe:2.3:a:longwatchstudio:woovip:*:*:*:*:*:wordpress:*:* Versions up to 1.4.4 Vulnerable ·Long Watch Studio
- cpe:2.3:a:longwatchstudio:woovirtualwallet:*:*:*:*:*:wordpress:*:* Versions up to 2.2.1 Vulnerable ·Long Watch Studio
- cpe:2.3:a:arcstone:amo_for_wp_-_membership_management:*:*:*:*:*:wordpress:*:* Versions up to 4.6.6 Vulnerable ·Arcstone
- cpe:2.3:a:wpopal:wpopal_core_features:*:*:*:*:*:wordpress:*:* Versions up to 1.5.8 Vulnerable ·wpopal
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2022-40700
- 2026-10-03 Alias added: GHSA-3mv9-fmvf-xvmx
References
Advisory 15
- https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plugin-6-0-1-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/woovip/wordpress-woovip-plugin-1-4-4-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/woosupply/wordpress-woosupply-plugin-1-2-2-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/qards-free/wordpress-wordpress-page-builder-qards-plugin-1-0-5-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpress-custom-login-admin-front-end-css-plugin-1-4-1-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plugin-1-5-0-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
- https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-request-forgery-ssrf?_s_id=cve
- https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-request-forgery-ssrf-vulnerability?_s_id=cve
Sources
- CVE-2022-40700 · CVE Program
- CVE-2022-40700 · NVD
- FIRST EPSS
- GHSA-3mv9-fmvf-xvmx · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences