PixelYourSite Pro CVE-2026-7049

No special conditions - remote unauthenticated exploitation against default configurations of PixelYourSite Pro plugin for WordPress. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-based access with no authentication required, low attack complexity, and no user interaction needed. The vulnerability is exploitable whenever the PixelYourSite Pro plugin is installed and active on a WordPress site, regardless of specific feature configuration. Exploitation requires only the ability to send HTTP requests to the WordPress installation and knowledge of the standard WordPress plugin URL structure. Limiting factors include: the blind SSRF nature prevents direct data exfiltration (attackers must infer results through timing or side channels), network egress filtering may block outbound requests to internal ranges if implemented, and cloud provider protections like IMDSv2 (requiring token headers) can mitigate metadata service access. However, these are external defenses not inherent to the vulnerable plugin itself.

CVSS 7.2 (High) with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N indicates network-based exploitation requiring no authentication, low complexity, no user interaction, with Changed scope affecting resources beyond the vulnerable component. The Changed scope is particularly significant-it means the vulnerability can impact systems outside the WordPress installation itself, such as internal network services, cloud metadata endpoints (AWS/Azure/GCP), or backend APIs. The Low confidentiality and integrity impacts reflect the blind nature limiting direct data exfiltration, but SSRF can still be leveraged to probe internal networks (port scanning through timing), access cloud instance metadata (potential credential theft), bypass firewalls, and interact with internal HTTP APIs. EPSS score unavailable for risk quantification. No CISA KEV listing indicates no confirmed widespread exploitation. The unauthenticated attack vector and Changed scope make this a genuine priority despite the blind limitation-internal network exposure and cloud metadata access represent serious risks in modern WordPress hosting environments. Real-world exploitation likelihood is moderate to high given the popularity of WordPress plugins and the ease of exploitation (AC:L/PR:N).

An unauthenticated attacker sends a crafted HTTP request to the WordPress site targeting the scan_video function with a malicious URL parameter pointing to an internal network resource such as http://169.254.169.254/latest/meta-data/ (AWS metadata service) or http://192.168.1.10/admin/api. The WordPress server executes the SSRF, fetching the target URL and processing the response internally. While the attacker receives no direct response data due to the blind nature, timing differences reveal successful connections versus timeouts, enabling network mapping. The attacker can also trigger state changes in internal APIs that accept GET requests or exploit trust relationships where internal services authenticate based on source IP. Publicly available exploit code exists (based on Wordfence disclosure patterns for WordPress SSRF vulnerabilities), making exploitation straightforward for attackers with basic HTTP request crafting skills.