OneStore Sites <= 0.1.1 - Unauthenticated Blind Server-Side Request Forgery
No known patch is available for this vulnerability.
The affected plugin has been removed from the WordPress.org directory (reason: Security Issue), and no patched version is being distributed through the official directory. If you have the affected software installed, you should uninstall or replace it rather than wait for an update.
Description
The OneStore Sites plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.1.1 via the class-export.php file. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2- Range: <=0.1.1
- sainwp/OneStore Sitesv5Range: 0
Patches
Vulnerability mechanics
Root cause
"Missing authentication and authorization checks in the export functionality allow unauthenticated attackers to trigger Server-Side Request Forgery (SSRF) via the `from_onestore` parameter."
Attack vector
An unauthenticated attacker triggers the SSRF by sending a crafted HTTP request to the WordPress site with the `from_onestore=placeholder` parameter, which invokes the `export_wp()` method in `class-export.php` [ref_id=1]. The export process fetches external resources (e.g., attachment URLs, image URLs inside post content) from attacker-controlled or internal addresses. This allows the attacker to make web requests originating from the web application's server, potentially querying or modifying information from internal services that are not directly accessible from the internet.
Affected code
The vulnerability resides in the `class-export.php` file of the OneStore Sites plugin (versions ≤ 0.1.1). The `export_wp()` method and its helper `get_export_file_name()` are reachable via the `from_onestore` GET parameter without any authentication checks, and the export routine makes outbound requests to arbitrary URLs derived from post content and attachment URLs, enabling Server-Side Request Forgery (SSRF).
What the fix does
The advisory does not provide a specific patch diff. To remediate the SSRF vulnerability, the plugin should add authentication and authorization checks before allowing the export functionality to be invoked, and restrict the URLs that can be fetched to a whitelist of trusted domains, preventing requests to internal or private IP ranges. Without a published fix, users should disable or remove the plugin until an update is available.
Preconditions
- configThe OneStore Sites plugin must be installed and activated on the WordPress site.
- authNo authentication is required; the attacker can be unauthenticated.
- networkThe attacker must be able to send HTTP requests to the WordPress site.
- inputThe attacker sends a GET request with the parameter `from_onestore=placeholder`.
Generated on Jun 16, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.
References
2News mentions
0No linked articles in our index yet.