Paid Member Subscriptions CVE-2026-57348

No authentication or user interaction is required (PR:N/UI:N), and the attack is delivered over the network (AV:N) at low complexity (AC:L) against Paid Member Subscriptions <= 3.0.4, so default installations of the vulnerable plugin are exposed. The practical value of exploitation is limited by the victim's internal environment: the WordPress host must have network reachability to a useful internal target (cloud metadata service, internal API, or intranet host) for the SSRF to yield meaningful data, and egress firewalling or a WAF would blunt it. Because impact is rated C:L/I:L, the flaw supports reconnaissance/limited data disclosure and internal pivoting rather than direct code execution.

The signals are moderate and internally consistent. CVSS 3.1 is 7.2 (High) with AV:N/AC:L/PR:N/UI:N - network-reachable, low complexity, no privileges or user interaction - which favors easy triggering, but impact is limited to C:L/I:L/A:N (partial confidentiality/integrity, no availability loss), reflecting that SSRF typically yields blind or limited data exposure rather than full compromise. The Scope:Changed elevates the score because the WordPress host can be pivoted against other systems. No EPSS score, no KEV listing, and no POC were provided, so there is no evidence of active or automated exploitation; this reads as a real but not emergency priority. Note a limitation: SSRF real-world severity depends heavily on the victim's internal network (presence of cloud metadata services, unauthenticated internal APIs), which the input data does not describe - impact could be higher or lower than the base score in a given environment.

An unauthenticated attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a URL parameter pointing at an internal target, such as http://169.254.169.254/latest/meta-data/ or an internal admin service. The WordPress server dutifully makes the request from its own network position, and the attacker uses the response (or timing/behavioral differences) to enumerate internal hosts or harvest cloud credentials. No public POC was provided, but the low attack complexity (AC:L) and lack of authentication make weaponization straightforward.