CVE-2022-2267: falha em Mailchimp for WooCommerce
MailChimp for Woocommerce < 2.7.1 - Subscriber+ SSRF
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 0.7%
The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
Produtos afetados
Unknown · Mailchimp for WooCommerceCVEs relacionadas — Mailchimp for WooCommerce
No mesmo produto, das mais perigosas para as menos.
CVE-2022-2556—MailChimp for Woocommerce < 2.7.2 - Admin+ SSRFEPSS 0.8%CVE-2026-92435MEDIUMMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST APIEPSS 0.3%CVE-2026-92436MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOREPSS 0.3%CVE-2026-92437MEDIUMMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and DeletionEPSS 0.2%