The OneStore Sites plugin for WordPress contains an SSRF vulnerability (CWE-918) in the class-export.php file in versions up to 0.1.1. This flaw permits unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations, potentially exposing or modifying internal service data. The vulnerability is publicly documented as CVE-2024-13905 with a CVSS 3.1 base score of 5.3 (medium severity). There is no vendor advisory or patch link available at this time, and it is not a cloud service, so remediation depends on plugin updates from the vendor.

An attacker can exploit this SSRF vulnerability to make the vulnerable server perform HTTP requests to arbitrary internal or external resources. This may lead to unauthorized information disclosure or manipulation of internal services accessible from the server. The impact is limited to information disclosure (confidentiality) with no direct integrity or availability impact reported. No known exploits are currently observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the OneStore Sites plugin if not essential. Monitoring for updates from sainwp and applying any future patches promptly is recommended.