The Oxygen WooCommerce WordPress theme contains an SSRF vulnerability (CWE-918) in the laborator_calc_route AJAX action in all versions up to 6.0.8. This flaw allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations, potentially accessing or modifying internal service data. The vulnerability is publicly disclosed with a CVSS v3.1 score of 7.2 (high severity), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity. No patch or official fix details are currently available from the vendor, and the product is not a cloud service, so remediation depends on vendor updates or user mitigations.

An attacker can exploit this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal or external systems. This may lead to unauthorized information disclosure and modification of data within internal services accessible from the server. The vulnerability does not directly impact availability. The high CVSS score reflects the potential confidentiality and integrity impacts due to the SSRF.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider implementing network-level restrictions to limit the server's ability to make arbitrary outbound requests, and review access controls on internal services to reduce potential impact.