CVE-2022-40700: agence-press css_adder Server-Side Request Forgery (SSRF)
Vulnerability summary
CVE-2022-40700 is a critical (CVSS 9.8) Server-Side Request Forgery (SSRF) vulnerability in agence-press css_adder. EPSS estimates a 1.00% chance of exploitation in the next 30 days, higher than 62.2% of scored vulnerabilities.
Timeline
- 19-01-2024PublishedVulnerability first disclosed.
- 28-04-2026Last modifiedVulnerability information updated.
Description
Server-Side Request Forgery (SSRF) vulnerability in Montonio Montonio for WooCommerce, Wpopal Wpopal Core Features, AMO for WP – Membership Management ArcStone wp-amo, Long Watch Studio WooVirtualWallet – A virtual wallet for WooCommerce, Long Watch Studio WooVIP – Membership plugin for WordPress and WooCommerce, Long Watch Studio WooSupply – Suppliers, Supply Orders and Stock Management, Squidesma Theme Minifier, Paul Clark Styles styles, Designmodo Inc. WordPress Page Builder – Qards, Philip M. Hofer (Frumph) PHPFreeChat, Arun Basil Lal Custom Login Admin Front-end CSS, Team Agence-Press CSS Adder By Agence-Press, Unihost Confirm Data, deano1987 AMP Toolbox amp-toolbox, Arun Basil Lal Admin CSS MU.This issue affects Montonio for WooCommerce: from n/a through 6.0.1; Wpopal Core Features: from n/a through 1.5.8; ArcStone: from n/a through 4.6.6; WooVirtualWallet – A virtual wallet for WooCommerce: from n/a through 2.2.1; WooVIP – Membership plugin for WordPress and WooCommerce: from n/a through 1.4.4; WooSupply – Suppliers, Supply Orders and Stock Management: from n/a through 1.2.2; Theme Minifier: from n/a through 2.0; Styles: from n/a through 1.2.3; WordPress Page Builder – Qards: from n/a through 1.0.5; PHPFreeChat: from n/a through 0.2.8; Custom Login Admin Front-end CSS: from n/a through 1.4.1; CSS Adder By Agence-Press: from n/a through 1.5.0; Confirm Data: from n/a through 1.0.7; AMP Toolbox: from n/a through 2.1.1; Admin CSS MU: from n/a through 2.6.
CVSS metrics
3 scores · 3 sources · 1 version- CVE.orgCNA8.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NDiffers
- wordfenceSource8.3HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:LDiffers
EPSS trend
Probability
1.00%
Chance of exploitation in the next 30 days
Percentile
62%
Versus all other CVEs
30-day change
0.00 pp
From 1.00% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Wordpress14 products
- admin-css-mu≤ 2.6 (fixed in 2.7)
- amp-toolbox≤ 2.1.1
- confirm-data≤ 1.0.7
- css-adder-by-agence-press≤ 1.5.0
- custom-login-admin-front-end-css-with-multisite-support≤ 1.4.1 (fixed in 1.5)
Long watch studio3 products
- woosupply – suppliers, supply orders and stock management≥ n/a, ≤ 1.2.2
- woovip – membership plugin for wordpress and woocommerce≥ n/a, ≤ 1.4.4
- woovirtualwallet – a virtual wallet for woocommerce≥ n/a, ≤ 2.2.1
Longwatchstudio3 products
- woosupply≤ 1.2.2
- woovip≤ 1.4.4
- woovirtualwallet≤ 2.2.1
Arun basil lal2 products
- admin css mu≥ n/a, ≤ 2.6
- custom login admin front-end css≥ n/a, ≤ 1.4.1
Millionclues2 products
- admin_css_mu≤ 2.6
- custom_login_admin_front-end_css≤ 1.4.1
Agence-press1 product
- css_adder≤ 1.5.0
Amo for wp – membership management1 product
- arcstone≥ n/a, ≤ 4.6.6
Arcstone1 product
Deano1 product
- amp_toolbox≤ 2.1.1
Deano19871 product
- amp toolbox≥ n/a, ≤ 2.1.1
Designmodo1 product
- qards≤ 1.0.5
Designmodo inc.1 product
- wordpress page builder – qards≥ n/a, ≤ 1.0.5
Frumph1 product
- phpfreechat≤ 0.2.8
Montonio1 product
- montonio_for_woocommerce≥ n/a, ≤ 6.0.1 | ≤ 6.0.1
Paul clark1 product
- styles≥ n/a, ≤ 1.2.3
Paulclark1 product
- styles≤ 1.2.3
Philip m. hofer (frumph)1 product
- phpfreechat≥ n/a, ≤ 0.2.8
Squidesma1 product
- theme_minifier≥ n/a, ≤ 2.0 | ≤ 2.0
Team agence-press1 product
- css adder by agence-press≥ n/a, ≤ 1.5.0
Unihost1 product
- confirm_data≥ n/a, ≤ 1.0.7 | ≤ 1.0.7
Wpopal1 product
- wpopal_core_features≥ n/a, ≤ 1.5.8 | ≤ 1.5.8
21 vendors · 40 products