Unauthenticated SSRF in Paid Member Subscriptions

Impact Analysis

Exploitation of this SSRF vulnerability can lead to the affected website making unauthorized requests to arbitrary domains, which may expose sensitive information from other services running on the same system.

Attackers could leverage this to access internal resources, potentially leading to data leakage or further attacks within the network.

Because the vulnerability requires no authentication, it can be exploited remotely and at scale, making it a significant risk especially for websites with many users.

Useful 0 Not Useful 0

Mitigation Strategies

To mitigate the Server Side Request Forgery (SSRF) vulnerability in the Paid Member Subscriptions plugin (versions 3.0.4 and earlier), users should immediately update the plugin to version 3.0.5 or later, which contains the patch for this issue.

Until the update can be applied, it is advised to implement the mitigation rule issued by Patchstack to block attacks exploiting this vulnerability.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows an attacker to force the website to make requests to arbitrary domains, potentially exposing sensitive information from other services running on the system.

Such exposure of sensitive information could lead to non-compliance with data protection regulations like GDPR and HIPAA, which require safeguarding personal and sensitive data against unauthorized access or disclosure.

Therefore, if exploited, this SSRF vulnerability could compromise the confidentiality and integrity of sensitive data, impacting compliance with these common standards and regulations.

Useful 0 Not Useful 0

Detection Guidance

The vulnerability is an unauthenticated Server Side Request Forgery (SSRF) in the Paid Member Subscriptions WordPress plugin versions 3.0.4 and earlier. Detection involves monitoring for unusual outbound requests originating from the web server to arbitrary domains, which may indicate exploitation attempts.

Since the vulnerability allows attackers to force the website to make requests to arbitrary domains, you can detect it by inspecting web server logs and network traffic for suspicious outbound HTTP requests that are not typical for your application.

Suggested commands to help detect potential exploitation attempts include:

• Using tcpdump or tshark to monitor outbound HTTP requests from the server: tcpdump -i eth0 -A 'tcp dst port 80 or tcp dst port 443'
• Checking web server access logs for unusual request patterns or parameters that might trigger SSRF.
• Using grep to search for suspicious URLs or parameters in logs: grep -i 'http://' /var/log/apache2/access.log
• Employing web application firewall (WAF) rules or Patchstack mitigation rules to block or log SSRF attempts until the plugin is updated.

Ultimately, the best mitigation is to update the Paid Member Subscriptions plugin to version 3.0.5 or later.

Useful 0 Not Useful 0

Executive Summary

CVE-2026-57348 is a Server Side Request Forgery (SSRF) vulnerability found in the WordPress Paid Member Subscriptions Plugin versions 3.0.4 and earlier.

This vulnerability allows an unauthenticated attacker to make the affected website send requests to arbitrary domains. Essentially, the attacker can trick the server into communicating with other internal or external services that it normally should not access.

The flaw requires no authentication to exploit and is considered moderately dangerous with a CVSS score of 7.2. It falls under the OWASP Top 10 category A10: Server-Side Request Forgery (SSRF).

Useful 0 Not Useful 0