OneStore Sites WordPress Plugin Server-Side Request Forgery Vulnerability

A server-side request forgery (SSRF) vulnerability has been identified in the OneStore Sites plugin for WordPress, affecting all versions through 0.1.1. The vulnerability resides in the class-export.php file, allowing unauthenticated attackers to make web requests to arbitrary locations from the web application. This could be exploited to query and modify information from internal services.

Impact

Exploitation of this vulnerability allows for unauthenticated blind server-side request forgery, enabling attackers to make requests to internal services and potentially manipulate or access sensitive information.

Remediation

There is no known patch available for this vulnerability. It is recommended to review the vulnerability details and consider uninstalling the affected plugin.