WPJAM Basic CVE-2026-57372

Exploitation requires a network-reachable WordPress site running WPJAM Basic version 7.0 or earlier with the SSRF-affected feature active; the attacker submits an attacker-controlled destination (URL/host) to the plugin, which the server then fetches. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no user interaction and no privileges required, implying default configurations are reachable - however, the description does not name the exact vulnerable feature or endpoint, and PR:N (unauthenticated) is not corroborated by the description, so authentication may in practice be required. Limiting factors: only Low confidentiality/integrity impact (partial data disclosure/limited request forgery, no availability loss), effectiveness depends on the server's ability to reach useful internal targets, and outbound egress filtering or a WAF materially reduces exploitability.

The supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N) yields 7.2 (High), driven mainly by the Changed scope and the network-reachable, low-complexity, no-privilege exploitability rather than by heavy impact, which is only Low/Low on confidentiality and integrity with no availability effect. No EPSS score, KEV entry, or POC was provided, so there is no evidence of active or widespread exploitation - the score reflects potential, not observed, abuse. One caveat: the vector claims PR:N (unauthenticated), yet many WordPress management-plugin SSRFs are reachable only via authenticated endpoints, and the terse description does not confirm the exact entry point - verify the trigger path with Patchstack/vendor before treating this as fully pre-auth. Net assessment: a legitimate High-priority patching item for sites running WPJAM Basic, but likely targeted/opportunistic rather than mass-exploited given the limited impact and absence of an exploit signal.

An attacker sends a crafted request to the vulnerable WPJAM Basic endpoint supplying an internal URL (for example the cloud metadata service or an internal admin panel), causing the WordPress server to fetch it and return limited content back to the attacker. With low attack complexity and network reachability, this can be used to map internal services or retrieve information from resources not exposed to the internet. No public POC was included in the source data.