title: MailChimp for Woocommerce < 2.7.2 - Admin+ SSRF
description: The Mailchimp for WooCommerce WordPress plugin before 2.7.2 has an AJAX action that allows high privilege users to perform a POST request on behalf of the server to the internal network/LAN, the body of the request is also appended to the response so it can be used to scan private network for example
problem types: CWE-918 Server-Side Request Forgery (SSRF)
affected:
{
product: Mailchimp for WooCommerce
vendor: Unknown
versions:
lessThan: 2.7.2, status: affected, version: 2.7.2, versionType: custom
}