CVE-2022-2267

The CVE-2022-2267 entry concerns the WordPress plugin Mailchimp for WooCommerce (versions prior to 2.7.1). A vulnerable AJAX action allows any logged-in user (e.g., subscribers) to make a server-side POST request to the internal network/LAN, with the request body echoed back in the response. This...

CVE-2022-2556

The CVE-2022-2556 issue affects the Mailchimp for WooCommerce WordPress plugin prior to 2.7.2. An authenticated AJAX action allows high-privilege users to make the server perform a POST to an internal LAN, and the request body is echoed in the response, enabling SSRF against private network resou...