Reference page — cumulative record through Wednesday, August 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.
AV AC PR UI S C I A CVSS EPSS %ile KEV N H N N U H N N 5.9 .0027 19.8 —
AFFECTED Product Versions Fixed WooMS unspecified —
TIMELINE Jun 29 Reserved by WPScan Aug 16 EXPLOIT PUBLISHED — CVE-2026-13700 (Unknown WooMS). Public exploit reference added. Aug 17 Published (CNA: WPScan)
The WooMS WordPress plugin through 9.14 does not validate a user-supplied URL before using it in a server-side request and attaches stored third-party integration credentials to every such request, allowing unauthenticated attackers to perform Server-Side Request Forgery and to disclose the configured integration credentials when the relevant data-sync feature is enabled.
| Date | Event | Detail |
|---|---|---|
| June 29, 2026 | Reserved | Reserved by WPScan |
| August 16, 2026 | EXPLOIT PUBLISHED | EXPLOIT PUBLISHED — CVE-2026-13700 (Unknown WooMS). Public exploit reference added. |
| August 17, 2026 | Published | Published (CNA: WPScan) |
| Vendor | Product / Package | Ecosystem | Version introduced | Fixed |
|---|---|---|---|---|
| Unknown | WooMS | — | — | — |
Authoritative record: CVE-2026-13700 at cve.org
Weaknesses: CWE-918
This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-13700 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Wednesday, August 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.