CVE-2026-57348: Unauthenticated SSRF in Paid Member Subscriptions <= 3.0.4

Technical summary

CVE-2026-57348 is an SSRF vulnerability (CWE-918) affecting Paid Member Subscriptions <= 3.0.4. The vulnerability permits unauthenticated attackers to craft malicious requests that cause the server to fetch URLs or interact with internal resources. The attack vector is network-based with low complexity, requires no privileges or user interaction, and has a scope change impact. While confidentiality and integrity are partially compromised, availability is not affected per the CVSS 3.1 vector (7.2/HIGH).

Business impact

Organizations relying on the Paid Member Subscriptions plugin face exposure of internal systems and data. An attacker could pivot from the vulnerable plugin to access internal databases, APIs, or microservices not directly exposed to the internet. In subscription-based business models, this could lead to unauthorized access to member data, billing information, or service disruption. The lack of authentication requirement significantly lowers the barrier to exploitation.

Affected systems

Paid Member Subscriptions plugin versions 3.0.4 and earlier are affected. Organizations should verify whether this plugin is active in their environment and confirm their current installed version. If the plugin is disabled or not deployed, risk is mitigated.

Exploitability

This vulnerability is highly exploitable due to the lack of authentication requirements, low attack complexity, and network accessibility. An attacker only needs to craft a malicious request to trigger the SSRF condition; no user interaction is required. The scope change indicates the impact extends beyond the vulnerable component itself, making it a network-reachable attack surface for external threat actors.

Remediation

Update Paid Member Subscriptions to a version newer than 3.0.4. Verify the specific patched version by consulting the vendor's security advisory or plugin repository. Until patching is possible, consider disabling the plugin if not critical to operations, or restrict network access from the plugin server to sensitive internal systems using firewall rules or network segmentation.

Patch guidance

Upgrade Paid Member Subscriptions to a version released after 3.0.4. Confirm patch availability through the plugin's official repository or vendor security advisory before deploying to production. Test the patched version in a staging environment to validate compatibility with your WordPress installation and any dependent functionality.

Detection guidance

Monitor for unusual outbound requests originating from the web server hosting Paid Member Subscriptions, particularly to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) or localhost services. Review access logs for requests containing suspicious URL parameters that reference internal hostnames or IP addresses. Implement Web Application Firewall (WAF) rules to block requests containing common SSRF payloads targeting metadata services or internal endpoints.

Why prioritize this

HIGH CVSS score (7.2) combined with unauthenticated exploitability makes this a priority remediation target. The scope change means exploitation can impact systems beyond the plugin itself. Organizations should prioritize patching before threat actors discover and weaponize this flaw at scale.

Risk score, explained

The CVSS 3.1 score of 7.2 (HIGH) reflects the network attack vector, low complexity, lack of authentication, and scope change. While the impact to confidentiality and integrity is partial (L), the absence of authentication and the cross-boundary impact elevate overall risk. This is not yet a CVSS 9+ critical vulnerability, but it remains significantly above the 'medium' threshold and warrants urgent attention.

Frequently asked questions