What is the CVSS score of CVE-2026-39645?

CVE-2026-39645 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Globalpayments Woocommerce CVE-2026-39645

EUVD-2026-20305 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-04-08 Patchstack

GHSA-h45w-7h64-7676

WordPress SSRF Globalpayments Woocommerce Wordpress Plugin

5.4

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

5.4 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from Vendor (Patchstack) · only source for this CVE.

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 15, 2026 - 12:42 vuln.today

CVSS changed

Apr 13, 2026 - 21:22 NVD

5.4 (MEDIUM)

EUVD ID Assigned

Apr 08, 2026 - 08:45 euvd

EUVD-2026-20305

CVE Published

Apr 08, 2026 - 08:30 nvd

N/A

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.

AnalysisAI

Server-Side Request Forgery (SSRF) in Global Payments GlobalPayments WooCommerce plugin versions up to 1.18.0 allows unauthenticated remote attackers to forge requests from the affected server with limited confidentiality and integrity impact. The vulnerability requires high attack complexity, which significantly reduces practical exploitation risk despite network-accessible attack surface; EPSS score of 0.02% (4th percentile) indicates minimal likelihood of real-world exploitation.

Technical ContextAI

The vulnerability exists in the Global Payments WooCommerce plugin (CPE: cpe:2.3:a:global_payments:globalpayments_woocommerce:*:*:*:*:*:*:*:*), a WordPress payment gateway integration. SSRF vulnerabilities (CWE-918) occur when an application accepts user-controlled input to construct requests to external systems without proper validation. In this case, the plugin likely processes payment-related requests or webhook callbacks in a manner that allows an attacker to manipulate the destination or parameters of server-initiated HTTP requests, potentially reaching internal services, cloud metadata endpoints, or other restricted resources from the WordPress server's network context. The high attack complexity requirement (AC:H) suggests the exploitation path requires specific conditions such as race conditions, precise timing, or non-standard configurations.

RemediationAI

Update the Global Payments GlobalPayments WooCommerce plugin to version 1.18.1 or later immediately. For WordPress site administrators, access the WordPress plugin management dashboard, navigate to the GlobalPayments WooCommerce plugin, and apply the available update. If an update beyond 1.18.0 is not yet available from the vendor, disable the plugin temporarily until a patched version is released. Refer to the Patchstack security advisory at https://patchstack.com/database/Wordpress/Plugin/global-payments-woocommerce/vulnerability/wordpress-globalpayments-woocommerce-plugin-1-18-0-server-side-request-forgery-ssrf-vulnerability for additional patch timeline and workaround details if applicable.