EUVD-2026-41347
GHSA-7w66-jfcx-mxqh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated network SSRF (AV:N/AC:L/PR:N/UI:N) that pivots the server against other systems (S:C) with limited disclosure/manipulation and no availability loss (C:L/I:L/A:N).
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Unauthenticated Server Side Request Forgery (SSRF) in Paid Member Subscriptions <= 3.0.4 versions.
AnalysisAI
Server-Side Request Forgery in the Paid Member Subscriptions WordPress plugin (versions 3.0.4 and earlier by Cozmoslabs) lets remote unauthenticated attackers coerce the WordPress server into issuing arbitrary outbound HTTP requests. Per the CVSS vector (PR:N, S:C) the flaw is reachable without authentication and crosses a security boundary, enabling attackers to reach internal-only services, cloud metadata endpoints, or other back-end systems the WordPress host can talk to. There is no public exploit identified at time of analysis and the issue is not listed in CISA KEV; EPSS was not provided.
Technical ContextAI
The affected component is the Paid Member Subscriptions plugin (CPE cpe:2.3:a:cozmoslabs:paid_member_subscriptions), a membership, subscription and paywall solution for WordPress used to gate content and process member sign-ups. The root cause class is CWE-918 (Server-Side Request Forgery): the plugin takes an attacker-influenced value and uses it as the target of a server-initiated network request (e.g., an HTTP fetch via WordPress's HTTP API) without adequately validating or restricting the destination. Because the request originates from the WordPress server, it inherits that server's network position and can address hosts that are not reachable from the public internet, which is why the CVSS scope is marked Changed (S:C).
RemediationAI
Upgrade the Paid Member Subscriptions plugin to a version newer than 3.0.4 as published by Cozmoslabs; the exact fixed version is not confirmed in the provided data, so verify the current patched release via the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/paid-member-subscriptions/vulnerability/wordpress-paid-member-subscriptions-plugin-3-0-4-server-side-request-forgery-ssrf-vulnerability) and the plugin's WordPress.org page before deploying. If immediate patching is not possible, apply compensating controls: place the site behind a WAF with SSRF rules (such as Patchstack's own virtual patching) to filter malicious requests; restrict the WordPress server's outbound egress with a firewall so it can only reach required external endpoints, and explicitly block access to internal ranges (RFC1918) and the cloud metadata IP 169.254.169.254 - the trade-off is that legitimate outbound integrations must be allow-listed or they will break; and enforce IMDSv2 on AWS to blunt metadata theft. As a last resort, deactivate the plugin, accepting loss of membership/paywall functionality.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today