Description
The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Published: 2025-07-04
Score: 6.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Server‑Side Request Forgery allowing authenticated subscribers to direct the site to arbitrary internal resources
Action: Patch Now
AI Analysis

Impact

The vulnerability is a Server‑Side Request Forgery flaw that enables authenticated users with Subscriber or higher privileges to trigger web requests to arbitrary URLs from the WordPress application. This can expose sensitive internal services or be used to modify internal data. The weakness is mapped to CWE‑918.

Affected Systems

WordPress sites running the PayMaster for WooCommerce plugin by qazomardok, any installed version up to and including 0.4.31.

Risk and Exploitability

The reported CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must be authenticated with at least Subscriber level, implying potential insider threat or compromised accounts as the prerequisite.

Generated by OpenCVE AI on April 22, 2026 at 14:43 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the PayMaster for WooCommerce plugin to at least version 0.4.32, which removes the SSRF flaw.
  • If an immediate upgrade is not possible, restrict the wp_ajax_paym_status AJAX action so that only users with administrator capability can execute it, thereby blocking lower‑privilege users from exploiting the SSRF.
  • Continuously monitor outbound requests originating from the web application for unexpected internal service calls to detect and respond to any attempts to abuse this vulnerability.

Generated by OpenCVE AI on April 22, 2026 at 14:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-19922 The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
History

Wed, 09 Jul 2025 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Qazomardok
Qazomardok paymaster For Woocommerce
CPEs cpe:2.3:a:qazomardok:paymaster_for_woocommerce:*:*:*:*:*:wordpress:*:*
Vendors & Products Qazomardok
Qazomardok paymaster For Woocommerce

Tue, 08 Jul 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 04 Jul 2025 02:30:00 +0000

Type Values Removed Values Added
Description The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Title PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery
Weaknesses CWE-918
References
Metrics cvssV3_1

{'score': 6.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N'}

Subscriptions

Qazomardok Paymaster For Woocommerce
cve-icon MITRE

Status: PUBLISHED

Assigner: Wordfence

Published:

Updated: 2026-04-08T16:43:42.517Z

Reserved: 2025-06-26T14:58:12.466Z

Link: CVE-2025-6729

cve-icon Vulnrichment

Updated: 2025-07-08T14:25:31.796Z

cve-icon NVD

Status : Analyzed

Published: 2025-07-04T03:15:22.577

Modified: 2025-07-09T17:49:44.530

Link: CVE-2025-6729

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-04-22T14:45:19Z

Weaknesses