PT-2026-54991 · Cozmoslabs+1 · Paid Membership Subscriptions
CVSS v3.1
7.2
High
| Vector | AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
Paid Member Subscriptions versions prior to 3.0.5
Description
An unauthenticated Server-Side Request Forgery (SSRF) exists in the Paid Membership Subscriptions plugin for WordPress. This flaw allows an attacker to force the web application to make web requests to arbitrary locations, which can be leveraged to query or modify information from internal services. SSRF is a flaw where a server is tricked into making requests to an unintended location.
Recommendations
Update to a version newer than 3.0.4.
Fix
SSRF
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Paid Membership Subscriptions