1. Home
  2. CVE Database
  3. CVE-2022-2267
MEDIUM · 4.3

CVE-2022-2267

The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal ne...

Vulnerability Description

The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example

CVSS Score

4.3

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
NONE
Availability
NONE

Affected Products

VendorProductVersions
MailchimpMailchimp For Woocommerce< 2.7.1

Related Weaknesses (CWE)

CWE-918

References

FAQ

What is CVE-2022-2267?

CVE-2022-2267 is a vulnerability with a CVSS score of 4.3 (MEDIUM). The Mailchimp for WooCommerce WordPress plugin before 2.7.1 has an AJAX action that allows any logged in users (such as subscriber) to perform a POST request on behalf of the server to the internal ne...

How severe is CVE-2022-2267?

CVE-2022-2267 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2022-2267?

Check the references section above for vendor advisories and patch information. Affected products include: Mailchimp Mailchimp For Woocommerce.