What is the CVSS score of EUVD-2026-48078?

EUVD-2026-48078 has a CVSS 3.1 base score of 4.9 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

JetBooking EUVD-2026-48078

| CVE-2026-65466 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-23 Patchstack

GHSA-pwhx-w756-q27c

WordPress SSRF Wordpress Plugin Jetbooking Crocoblock Jetimpex Inc

4.9

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

4.9 MEDIUM

AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

4.9 MEDIUM

Network-reachable SSRF requires low-privilege auth (PR:L) and specific custom role configuration (AC:H); scope change (S:C) reflects internal system reach with limited C/I impact.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 23, 2026 - 13:26 vuln.today

DescriptionCVE.org

Custom role Server Side Request Forgery (SSRF) in JetBooking <= 4.1.2 versions.

AnalysisAI

Server-Side Request Forgery in the JetBooking WordPress plugin (versions up to and including 4.1.2) allows authenticated low-privilege users to force the server to issue arbitrary HTTP requests via the custom role functionality. With a scope-changed CVSS vector (S:C), successful exploitation can expose internal network resources and services not ordinarily reachable from the public internet, yielding limited confidentiality and integrity impact. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

JetBooking is a reservation and booking management plugin for WordPress, developed by Crocoblock (JetImpex Inc.), identified by CPE cpe:2.3:a:crocoblock._jetimpex_inc.:jetbooking:*:*:*:*:*:*:*:*. The root cause is CWE-918 (Server-Side Request Forgery): the plugin accepts attacker-controlled URL or host input through its custom role feature and passes it to a server-side HTTP client without adequate validation or allowlisting. This forces the WordPress host to act as a proxy, potentially querying internal cloud metadata endpoints (e.g., AWS IMDSv1), internal databases, or adjacent services on non-public network segments. The CVSS scope change (S:C) reflects that the impact extends beyond the WordPress application itself to these subsequent internal systems.

RemediationAI

Patch available per vendor advisory - consult the Patchstack database entry (https://patchstack.com/database/wordpress/plugin/jet-booking/vulnerability/wordpress-jetbooking-plugin-4-1-2-server-side-request-forgery-ssrf-vulnerability) and the official Crocoblock/JetBooking changelog for the exact patched release version, as no specific fix version was independently confirmed in the available data. While awaiting patching, restrict access to the JetBooking custom role functionality to trusted administrative accounts only, reducing the effective privilege surface. Additionally, implement an egress firewall rule on the WordPress host to block outbound HTTP/HTTPS requests to internal RFC-1918 addresses and cloud metadata endpoints (e.g., 169.254.169.254) - this directly limits SSRF reach to internal infrastructure. Note that blocking metadata endpoints may interfere with legitimate cloud provider integrations if any exist. Web Application Firewall rules targeting SSRF patterns in JetBooking endpoints can provide an additional layer but should not substitute for patching.