Free and open · new CVEs checked every 20 minutesStatusRSSOpen dataContact

CVE-2022-40700: Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Feat

49
This month
HIGH 8.2REMOTEUPGRADEUPGRADEUPGRADE

CVE-2022-40700 is a high-severity flaw (CVSS 8.2) affecting admin css mu, amp toolbox, confirm data. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.

Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Design

Why this priority

  • High severity
  • Remotely exploitable, no login, no user action

A fixed release or distro patch exists.

Risk facts

CVSS score8.2 (High)
Attack vectorNetwork (remote)
Attack complexityLow
Privileges neededNone
User interactionNone
EPSS exploit chance1.0% (top 37%)
CISA exploited listNo
WeaknessCWE-918
Published2024-01-19
Last modified2026-06-17
Publisher (CNA): Patchstack · Vendor: agence-press · deano · millionclues · montonio · unihost

Share: LinkedIn · X · Reddit

Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score

Am I affected?

Timeline

millionclues admin css mu UPGRADE
Affected: <= 2.6
Fixed in: newer than 2.6
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy admin-css-mu || rpm -q admin-css-mu || admin-css-mu --version
2. UPGRADE to newer than 2.6 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade admin-css-mu
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade admin-css-mu
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
deano amp toolbox UPGRADE
Affected: <= 2.1.1
Fixed in: newer than 2.1.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy amp-toolbox || rpm -q amp-toolbox || amp-toolbox --version
2. UPGRADE to newer than 2.1.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade amp-toolbox
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade amp-toolbox
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
unihost confirm data UPGRADE
Affected: <= 1.0.7
Fixed in: newer than 1.0.7
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy confirm-data || rpm -q confirm-data || confirm-data --version
2. UPGRADE to newer than 1.0.7 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade confirm-data
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade confirm-data
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
agence-press css adder UPGRADE
Affected: <= 1.5.0
Fixed in: newer than 1.5.0
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy css-adder || rpm -q css-adder || css-adder --version
2. UPGRADE to newer than 1.5.0 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade css-adder
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade css-adder
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
millionclues custom login admin front-end css UPGRADE
Affected: <= 1.4.1
Fixed in: newer than 1.4.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy custom-login-admin-front-end-css || rpm -q custom-login-admin-front-end-css || custom-login-admin-front-end-css --version
2. UPGRADE to newer than 1.4.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade custom-login-admin-front-end-css
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade custom-login-admin-front-end-css
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
montonio montonio for woocommerce UPGRADE
Affected: <= 6.0.1
Fixed in: newer than 6.0.1
Safe to downgrade to: no unaffected older release
1. Check installed version
apt-cache policy montonio-for-woocommerce || rpm -q montonio-for-woocommerce || montonio-for-woocommerce --version
2. UPGRADE to newer than 6.0.1 (Debian / Ubuntu)
sudo apt update && sudo apt install --only-upgrade montonio-for-woocommerce
2. UPGRADE (RHEL / Amazon Linux / Fedora)
sudo dnf upgrade montonio-for-woocommerce
Note
Distros often backport fixes without changing the version number. Confirm with the distro advisory or changelog.
Verify at the official source NVD · CVE Program · Report a problem with this page
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.

Quick answers

How do I fix CVE-2022-40700?

admin css mu: upgrade to newer than 2.6; amp toolbox: upgrade to newer than 2.1.1; confirm data: upgrade to newer than 1.0.7. Exact commands for each OS are on this page.

Is CVE-2022-40700 being exploited?

CVE-2022-40700 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.

What does CVE-2022-40700 affect?

CVE-2022-40700 affects admin css mu, amp toolbox, confirm data. Severity is high (CVSS 8.2). Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, L

How urgent is CVE-2022-40700?

Priority 49/100. High severity; Remotely exploitable, no login, no user action

Software pages

WordPress vulnerabilities · WooCommerce vulnerabilities

References

← Back to latest CVEs

Get the weekly exploited-CVE digest by emailThe CVEs being attacked this week and how to fix them. No spam, unsubscribe any time.