What is the CVSS score of CVE-2026-44583?

CVE-2026-44583 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.

Is there a patch available for CVE-2026-44583?

Yes, a patch is available for CVE-2026-44583. Update the affected software to the latest version immediately.

Paymenter CVE-2026-44583

MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-06-22 https://github.com/Paymenter/Paymenter

GHSA-7wwh-xcc3-9fcg

SSRF

5.3

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

vuln.today AI

5.3 MEDIUM

Unauthenticated network endpoint with no complexity barriers; confidentiality limited to Low because SSRF is blind with no direct response returned.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

Jun 22, 2026 - 20:51 vuln.today

Analysis Generated

Jun 22, 2026 - 20:51 vuln.today

DescriptionGitHub Advisory

Summary

The PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations.

Technical details:

The /extensions/paypal/webhook endpoint processes incoming webhook requests and trusts the value of the PAYPAL-CERT-URL HTTP header without validation.

This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage.

As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations.

Impact

This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints.

Depending on network configuration, this may lead to:

Blind SSRF to external attacker-controlled systems
Potential access to internal network services

No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels.

AnalysisAI

Blind Server-Side Request Forgery in Paymenter's PayPal gateway module (versions < 1.5.0) allows remote unauthenticated attackers to coerce the application server into issuing arbitrary HTTP GET requests by supplying a malicious URL in the PAYPAL-CERT-URL HTTP header. The webhook endpoint at /extensions/paypal/webhook passes this header directly to PHP's file_get_contents() with no allowlist, domain validation, or signature pre-check, violating the security intent of PayPal's certificate verification flow. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send POST to /extensions/paypal/webhook

Delivery

Inject attacker URL in PAYPAL-CERT-URL header

Exploit

Server calls file_get_contents on attacker URL

Execution

Pivot to probe internal network endpoints

Impact

Enumerate accessible internal services via blind callbacks

Access

Send POST to /extensions/paypal/webhook

Delivery

Inject attacker URL in PAYPAL-CERT-URL header

Exploit

Server calls file_get_contents on attacker URL

Execution

Pivot to probe internal network endpoints

Impact

Enumerate accessible internal services via blind callbacks

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the target Paymenter instance has the PayPal payment gateway extension installed and active, and that the /extensions/paypal/webhook endpoint is network-reachable by the attacker - which is typically true by design for any live payment processing deployment. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The NVD-assigned CVSS 3.1 score of 5.3 Medium (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N) accurately reflects the network-accessible, zero-authentication, low-complexity nature of the attack, with confidentiality impact limited to Low due to the blind nature of the SSRF - no direct response data is returned to the attacker. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker sends an HTTP POST request to https://target-paymenter.example.com/extensions/paypal/webhook with the header PAYPAL-CERT-URL: http://attacker-vps.example.com/log set to an attacker-controlled listener. The Paymenter server issues a file_get_contents() GET request to that URL, revealing its public egress IP. …
Remediation	Upgrade Paymenter to version 1.5.0 or later, which is confirmed by the vendor's GitHub Security Advisory GHSA-7wwh-xcc3-9fcg (https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg) as the patched release. … Detailed patch versions, workarounds, and compensating controls in full report.