The Laborator Oxygen WooCommerce theme contains a critical Server-Side Request Forgery vulnerability that allows unauthenticated attackers to interact with internal network resources.

This vulnerability is a Server-Side Request Forgery (CWE-918) triggered via the laborator_calc_route AJAX action. It allows unauthenticated attackers to force the web server to make arbitrary requests to internal or external services.

The ability for an unauthenticated actor to perform SSRF poses a significant risk to the internal network infrastructure. Attackers can leverage this to bypass firewalls, query internal metadata services, or interact with administrative interfaces that are not exposed to the public internet. Given the CVSS score of 7.2, this vulnerability is classified as High severity due to the potential for unauthorized data access and internal reconnaissance.

Immediate Action: Administrators should immediately update the Oxygen theme to the latest available version provided by Laborator. If a patch is not yet available, the theme should be deactivated or removed until a secure version can be deployed.

Proactive Monitoring: Security teams should monitor server access logs and outbound network traffic for suspicious requests originating from the web server, particularly those directed toward internal IP addresses or sensitive local ports.

Compensating Controls: A Web Application Firewall (WAF) should be configured to restrict access to the laborator_calc_route AJAX endpoint or block requests containing suspicious parameters that might be used to facilitate SSRF.

Public Exploit Available: Unknown

This vulnerability represents a significant entry point for an attacker to pivot into the internal network. Organizations utilizing the Oxygen theme must prioritize updating their installations as soon as the vendor releases a security fix. Until such time, isolating the affected application or implementing strict egress filtering on the web server remains the most effective strategy to prevent potential exploitation.