Server-Side Request Forgery in Amazon Products to WooCommerce Plugin for WordPress
CVE-2025-5817

7.2HIGH

Key Information:

Vendor

WordPress
Status
Amazon Products To WooCommerce
Vendor
CVE Published:
2 July 2025

What is CVE-2025-5817?

The Amazon Products to WooCommerce plugin for WordPress exhibits a serious vulnerability that permits Server-Side Request Forgery. This flaw affects all versions up to and including 1.2.7. It enables unauthorized attackers to initiate web requests to arbitrary locations from the web application, posing a risk for querying and potentially altering sensitive information accessed by internal services.

Affected Version(s)

Amazon Products to WooCommerce * <= 1.2.7

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/import-product...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ch4r0n
.