CVE-2026-44583

Name of the Vulnerable Software and Affected Versions Paymenter versions prior to 1.5.0

Description The PayPal webhook endpoint '/extensions/paypal/webhook' processes the PAYPAL-CERT-URL HTTP header without validation. This value is passed directly into a server-side HTTP request via the file get contents() function without any allowlist, validation, or signature verification. This allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints, leading to blind Server-Side Request Forgery (SSRF). SSRF is a flaw where an attacker can force a server to make requests to a destination of the attacker's choosing. While no direct response data is returned, this may enable sensitive network probing or data exfiltration via side channels.

Recommendations Update to version 1.5.0. As a temporary workaround, restrict access to the '/extensions/paypal/webhook' endpoint to trusted PayPal IP addresses.