What is the CVSS score of CVE-2026-57407?

CVE-2026-57407 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.3%.

Which versions of PDF Generator for WordPress are affected by CVE-2026-57407?

WP Swings' PDF Generator plugin for WordPress (all versions through 1.6.2) contains a server-side request forgery vulnerability that allows attackers to coerce affected WordPress servers into making…

How to fix or mitigate CVE-2026-57407?

Within 24 hours, complete an inventory of all WordPress deployments running WP Swings PDF Generator and identify which are at version 1.6.2 or earlier. Within 7 days, remove the plugin from all production WordPress environments after validating no critical business processes depend on its PDF generation functionality in a staging environment first. Within 30 days, procure and deploy an alternative PDF generation solution free from SSRF vulnerabilities, implement network-layer controls to restrict WordPress server outbound connections to a whitelist of authorized services, and establish continuous monitoring of WordPress server outbound connections to cloud IMDS and internal service ranges.

PDF Generator for WordPress CVE-2026-57407

EUVD-2026-43478 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-13 Patchstack

WordPress SSRF Wordpress Plugin Pdf Generator For Wordpress Wp Swings

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

6.4 MEDIUM

SSRF is network-reachable and low-complexity with scope change to internal systems; PR:L reflects that WordPress plugin SSRFs of this type typically require at least authenticated access, diverging from the source PR:N.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 13, 2026 - 10:57 vuln.today

CVE Published

Jul 13, 2026 - 08:41 cve.org

HIGH 7.2

DescriptionCVE.org

Server-Side Request Forgery (SSRF) vulnerability in WP Swings PDF Generator for WordPress pdf-generator-for-wp allows Server Side Request Forgery.This issue affects PDF Generator for WordPress: from n/a through <= 1.6.2.

Articles & Coverage 1

News 13 New WordPress Vulnerabilities - 1 Critical, 12 High, 4 With POC Jul 14, 2026

AnalysisAI

Server-Side Request Forgery in WP Swings' PDF Generator for WordPress plugin (all versions up to and including 1.6.2) lets remote attackers coerce the WordPress server into issuing attacker-controlled outbound requests, with a scope-changed impact reaching adjacent internal systems. Reported by Patchstack and tracked as CWE-918 with a CVSS 3.1 base score of 7.2, it currently has no public exploit identified at time of analysis and is not listed in CISA KEV. Because the scope is changed (S:C), successful abuse can pivot the server against internal metadata endpoints, intranet services, or cloud IMDS resources beyond the WordPress host itself.

Technical ContextAI

The affected component is the PDF Generator for WordPress plugin (CPE cpe:2.3:a:wp_swings:pdf_generator_for_wordpress), which converts WordPress content into downloadable PDFs. PDF-generation plugins routinely fetch remote resources - images, stylesheets, fonts, or user-supplied URLs - during rendering, and CWE-918 (Server-Side Request Forgery) arises when that fetch logic does not validate or restrict the destination, allowing an attacker to substitute an internal or attacker-chosen URL. The root cause class here is missing allowlist/SSRF protection on a server-side HTTP fetch, so the WordPress backend becomes an unwitting proxy. The changed CVSS scope (S:C) reflects that the security-relevant impact falls on systems other than the vulnerable web application - e.g., internal services the WordPress host can reach but an external attacker normally cannot.

RemediationAI

No vendor-released patch identified at time of analysis - the data lists all versions through 1.6.2 as affected without a confirmed fixed release, so consult the Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/pdf-generator-for-wp/vulnerability/wordpress-pdf-generator-for-wordpress-plugin-1-6-2-server-side-request-forgery-ssrf-vulnerability) and the plugin changelog for an update beyond 1.6.2 and upgrade as soon as one is published. Until then, apply compensating controls: enforce egress filtering so the WordPress host can only reach required external endpoints (blocking outbound access to 169.254.169.254 and RFC1918 ranges neutralizes cloud-metadata and intranet pivoting, at the cost of breaking legitimate internal fetches); place a WAF or virtual-patch rule (Patchstack offers one) in front of the PDF-generation endpoint; and if PDF generation is not essential, deactivate the plugin. Restricting the PDF-generation feature to authenticated, trusted roles reduces the attack surface but does not eliminate SSRF if the endpoint is reachable by low-privileged users.