CVE-2025-5817 is a Server-Side Request Forgery (SSRF) vulnerability in the Amazon Products to WooCommerce plugin for WordPress, affecting all versions up to and including 1.2.7. The issue arises in the wcta2w_get_urls() function, which can be abused by unauthenticated attackers to induce the server to send HTTP requests to arbitrary locations. This can lead to unauthorized querying and modification of internal services accessible from the server. The vulnerability has a CVSS 3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), reflecting high impact on confidentiality and integrity without affecting availability. No patch or official fix has been disclosed, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An attacker can exploit this SSRF vulnerability to make the vulnerable server send requests to arbitrary internal or external resources. This can lead to unauthorized access or modification of sensitive internal services and data. The impact affects confidentiality and integrity but does not affect availability. Since the vulnerability is exploitable without authentication and requires no user interaction, it poses a significant risk to affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring and restricting outbound HTTP requests from the server may help mitigate risk, but these are not definitive solutions. Users should stay alert for vendor updates or security advisories regarding this vulnerability.