CVE-2022-40700: Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

high Affects admin-css-mu (WordPress plugin), amo-for-wp---membership-management (WordPress plugin), amp-toolbox (WordPress plugin), confirm-data (WordPress plugin), css-adder (WordPress plugin), custom-login-admin-front-end-css (WordPress plugin) and 9 more. Feed 2026.10.29.4, updated 2026-10-29; published 2024-01-19; advisory modified 2026-06-17.

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: admin-css-mu (WordPress plugin) WordPress
Affected versions: <=2.6
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: amo-for-wp---membership-management (WordPress plugin) WordPress
Affected versions: <=4.6.6
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: amp-toolbox (WordPress plugin) WordPress
Affected versions: <=2.1.1
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: confirm-data (WordPress plugin) WordPress
Affected versions: <=1.0.7
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: css-adder (WordPress plugin) WordPress
Affected versions: <=1.5.0
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: custom-login-admin-front-end-css (WordPress plugin) WordPress
Affected versions: <=1.4.1
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: montonio-for-woocommerce (WordPress plugin) WordPress
Affected versions: <=6.0.1
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: phpfreechat (WordPress plugin) WordPress
Affected versions: <=0.2.8
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: qards (WordPress plugin) WordPress
Affected versions: <=1.0.5
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: styles (WordPress plugin) WordPress
Affected versions: <=1.2.3
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: theme-minifier (WordPress plugin) WordPress
Affected versions: <=2.0
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: woosupply (WordPress plugin) WordPress
Affected versions: <=1.2.2
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: woovip (WordPress plugin) WordPress
Affected versions: <=1.4.4
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: woovirtualwallet (WordPress plugin) WordPress
Affected versions: <=2.2.1
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWall

Package: wpopal-core-features (WordPress plugin) WordPress
Affected versions: <=1.5.8
Fixed in: no fix recorded
Severity: high CVSS 8.2
Exploitation: not on CISA KEV · EPSS 1% (62.7th percentile)
Published: 2024-01-19
Source: nvd

References

CWE-918

NVD record admin-css-mu (WordPress plugin) advisories amo-for-wp---membership-management (WordPress plugin) advisories amp-toolbox (WordPress plugin) advisories confirm-data (WordPress plugin) advisories css-adder (WordPress plugin) advisories custom-login-admin-front-end-css (WordPress plugin) advisories

Am I affected?

Find out in one command. phpwarden checks your WordPress install against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# PHP projects (recommended)
composer require --dev phpwarden/phpwarden
# then
vendor/bin/phpwarden wordpress /var/www/html

# or, without Composer
pipx install phpwarden   &&   phpwarden wordpress /var/www/html

Or keep it checked automatically with the GitHub Action or a nightly cron; see WordPress docs.

Install docs How findings are ranked

Related advisories

CVE-2021-21311 KEV high SSRF in adminer same weakness: CWE-918
CVE-2022-1386 critical The Fusion Builder WordPress plugin before 3.6.2, used in the Avada theme, does not valida same weakness: CWE-918
CVE-2021-32682 critical elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE same weakness: CWE-918
CVE-2023-2249 high The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Req same weakness: CWE-918
CVE-2021-24472 critical The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 same weakness: CWE-918
CVE-2019-16932 critical A blind SSRF vulnerability exists in the Visualizer plugin before 3.3.1 for WordPress via same weakness: CWE-918