CVE-2022-2556

The Mailchimp for WooCommerce plugin versions prior to 2.7.2 contain an AJAX function that permits administrators and other high-privileged users to initiate server-side POST requests to systems on the internal network or LAN. Because the request payload is reflected in the response, attackers with elevated permissions could leverage this capability to conduct reconnaissance and probe for vulnerable services across private networks.

Based on public CVE data (MITRE/NVD).