CVE-2026-13700: Unknown Wooms

Medium severity, CVSS 5.9. EPSS: 0.3% chance of exploitation in the next 30 days.

The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.

Affected products

• Unknown Wooms: up to and including 9.14

Published 2026-08-17. Last modified 2026-08-26.