CVE-2022-40700: millionclues admin css mu +14 lainnya

csirt@kutim:~/threat-intel/cve/CVE-2022-40700

CVSS 9.8 · Critical EPSS 1,00%

Kerentanan Server-Side Request Forgery (SSRF) pada millionclues admin css mu, deano amp toolbox +13 lainnya. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.

Rincian

Terbit di NVD: 19 Januari 2024
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-918: Server-Side Request Forgery (SSRF)
EPSS (30 hari): 1,00% peluang dieksploitasi; lebih tinggi dari 61,8% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
millionclues	admin css mu	Semua versi hingga 2.6
deano	amp toolbox	Semua versi hingga 2.1.1
unihost	confirm data	Semua versi hingga 1.0.7
agence-press	css adder	Semua versi hingga 1.5.0
millionclues	custom login admin front-end css	Semua versi hingga 1.4.1
montonio	montonio for woocommerce	Semua versi hingga 6.0.1
frumph	phpfreechat	Semua versi hingga 0.2.8
designmodo	qards	Semua versi hingga 1.0.5
paulclark	styles	Semua versi hingga 1.2.3
squidesma	theme minifier	Semua versi hingga 2.0
longwatchstudio	woosupply	Semua versi hingga 1.2.2
longwatchstudio	woovip	Semua versi hingga 1.4.4
longwatchstudio	woovirtualwallet	Semua versi hingga 2.2.1
arcstone	amo for wp - membership management	Semua versi hingga 4.6.6
wpopal	wpopal core features	Semua versi hingga 1.5.8

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://patchstack.com/database/vulnerability/admin-css-mu/wordpress-admin-css-mu-plugin-2-6-server-side-reque... advisory pihak ketiga
https://patchstack.com/database/vulnerability/amp-toolbox/wordpress-amp-toolbox-plugin-2-1-1-server-side-reque... advisory pihak ketiga
https://patchstack.com/database/vulnerability/confirm-data/wordpress-confirm-data-plugin-1-0-7-unauth-server-s... advisory pihak ketiga
https://patchstack.com/database/vulnerability/css-adder-by-agence-press/wordpress-css-adder-by-agene-press-plu... advisory pihak ketiga
https://patchstack.com/database/vulnerability/custom-login-admin-front-end-css-with-multisite-support/wordpres... advisory pihak ketiga
https://patchstack.com/database/vulnerability/montonio-for-woocommerce/wordpress-montonio-for-woocommerce-plug... advisory pihak ketiga
https://patchstack.com/database/vulnerability/phpfreechat/wordpress-phpfreechat-plugin-0-2-8-server-side-reque... advisory pihak ketiga
https://patchstack.com/database/vulnerability/qards-free/wordpress-wordpress-page-builder-qards-plugin-1-0-5-s... advisory pihak ketiga
https://patchstack.com/database/vulnerability/styles/wordpress-styles-plugin-1-2-3-server-side-request-forgery... advisory pihak ketiga
https://patchstack.com/database/vulnerability/theme-minifier/wordpress-theme-minifier-plugin-2-0-server-side-r... advisory pihak ketiga
https://patchstack.com/database/vulnerability/woosupply/wordpress-woosupply-plugin-1-2-2-server-side-request-f... advisory pihak ketiga
https://patchstack.com/database/vulnerability/woovip/wordpress-woovip-plugin-1-4-4-server-side-request-forgery... advisory pihak ketiga
https://patchstack.com/database/vulnerability/woovirtualwallet/wordpress-woovirtualwallet-plugin-2-2-1-server-... advisory pihak ketiga
https://patchstack.com/database/vulnerability/wp-amo/wordpress-amo-for-wp-plugin-4-6-6-server-side-request-for... advisory pihak ketiga
https://patchstack.com/database/vulnerability/wpopal-core-features/wordpress-wpopal-core-features-plugin-1-5-7... advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.