EUVD-2026-43448Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Network-reachable low-complexity SSRF with Changed scope and limited C/I impact; PR:L chosen because such WordPress plugin endpoints commonly require an authenticated session, though the source vector claims PR:N.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
2DescriptionCVE.org
Server-Side Request Forgery (SSRF) vulnerability in denishua WPJAM Basic wpjam-basic allows Server Side Request Forgery.This issue affects WPJAM Basic: from n/a through <= 7.0.
AnalysisAI
Server-Side Request Forgery in the WPJAM Basic WordPress plugin (by denishua) affects all versions up to and including 7.0, letting remote attackers coerce the site's server into issuing crafted outbound requests. Because the CVSS scope is marked Changed with low confidentiality and integrity impact, an attacker can reach internal or otherwise-protected services and read back limited responses. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; it was disclosed through the Patchstack vulnerability database.
Technical ContextAI
The flaw is a classic CWE-918 Server-Side Request Forgery: the plugin accepts an attacker-influenced URL or host value and performs a server-side HTTP fetch without adequately validating or restricting the destination, allowing the request to be redirected toward internal endpoints, cloud metadata services, or other unintended targets. The affected component is WPJAM Basic (CPE cpe:2.3:a:denishua:wpjam_basic), a general-purpose WordPress management/enhancement plugin that provides admin and content utilities; SSRF typically arises in such plugins from features that fetch remote images, thumbnails, feeds, or CDN/URL-processing helpers. WordPress plugins run inside the PHP application context, so a successful SSRF executes with the web server's network position and can pivot into the hosting environment's trust boundary - which is consistent with the Scope:Changed rating in the CVSS vector.
RemediationAI
No vendor-released patched version was identified in the provided data (all versions through 7.0 are listed as affected and no fix version is given), so first consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/wpjam-basic/vulnerability/wordpress-wpjam-basic-plugin-7-0-server-side-request-forgery-ssrf-vulnerability) and upgrade to any release later than 7.0 once published. Until a fixed version is confirmed, apply compensating controls: place a WordPress WAF/virtual patch (e.g., Patchstack) in front of the site to block SSRF payloads; restrict the web server's outbound network egress with a firewall so it cannot reach internal ranges (RFC1918, 127.0.0.1, and the 169.254.169.254 cloud metadata endpoint), accepting that legitimate outbound fetches the plugin performs may break; and consider disabling or removing WPJAM Basic if the SSRF-triggering feature is not required. Each control trades functionality or maintenance overhead for reduced exposure, and none is a substitute for the eventual vendor fix.
More in Wpjam Basic
View allWPJAM Basic, a WordPress plugin, contains an unrestricted file upload vulnerability (CWE-434) that allows attackers to u
SQL injection in the WPJAM Basic WordPress plugin (versions 7.0.1 and earlier, vendor denishua) lets attackers inject ar
PHP Object Injection in the WPJAM Basic WordPress plugin (denishua) affects all versions up to and including 7.0, allowi
Sensitive data exposure in WPJAM Basic (WordPress plugin, versions ≤ 7.0.2.1) allows unauthenticated remote attackers to
Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor pat
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today