[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fD85c-uQoqDYec3akZhiNW_lYN85UxUQTyDA_XLdYC1Q":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":26,"research_verified":27,"research_rounds_completed":28,"research_plan":29,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":30,"research_started_at":31,"research_completed_at":32,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":27,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":27,"source_links":33},"CVE-2026-57348","paid-membership-subscriptions-effortless-memberships-recurring-payments-content-restriction-unauthenticated-server-side-","Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction \u003C= 3.0.4 - Unauthenticated Server-Side Request Forgery","The Paid Membership Subscriptions – Effortless Memberships, Recurring Payments & Content Restriction plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.0.4. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.","paid-member-subscriptions",null,"\u003C=3.0.4","3.0.5","medium",6.1,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:C\u002FC:L\u002FI:L\u002FA:N","Server-Side Request Forgery (SSRF)","2026-07-01 00:00:00","2026-07-09 13:43:54",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F977a673c-075a-4662-b3e1-91a604e546f8?source=api-prod",9,[22,23,24,25],"assets\u002Fcss\u002Fstyle-front-end.css","assets\u002Fjs\u002Fadmin\u002Fsubmenu-page-settings-page.js","assets\u002Fjs\u002Ffront-end.js","includes\u002Fadmin\u002Fclass-admin-members.php","researched",false,3,"This research plan focuses on identifying and exploiting an unauthenticated Server-Side Request Forgery (SSRF) in the **Paid Membership Subscriptions** plugin.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Unauthenticated SSRF.\n*   **Location:** Likely within the payment gateway callback or IPN (Instant Payment Notification) handling logic, which is typically hooked to `init` or `wp_loaded` to listen for external requests from payment providers (like PayPal).\n*   **Cause:** The plugin accepts a URL or a target identifier from a user-controlled parameter (via `$_GET` or `$_POST`) and passes it to a sink like `wp_remote_get()` or `wp_remote_post()` without validating that the host is an authorized external service.\n*   **Impact:** Attackers can force the web server to make requests to internal services (e.g., `http:\u002F\u002Flocalhost:6379` for Redis, `http:\u002F\u002F169.254.169.254` for AWS metadata) or conduct port scanning of the internal network.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** The vulnerability is reachable via the main WordPress index (`\u002F`) or `wp-admin\u002Fadmin-ajax.php`, depending on how the handler is registered.\n*   **Action Trigger:** Based on `assets\u002Fjs\u002Ffront-end.js`, the plugin monitors parameters such as `pms_gateway_payment_action` and `pms_gateway_payment_id`.\n*   **Vulnerable Parameter:** Likely a parameter such as `ipn_url`, `webhook_url`, or a specific action that triggers a remote request (e.g., `pms_gateway_payment_action=verify_remote`).\n*   **Authentication:** Unauthenticated (AV:N\u002FPR:N).\n\n### 3. Code Flow (Inferred from Patterns)\n1.  **Entry Point:** The plugin registers a handler on the `init` hook (as seen in the pattern in `includes\u002Fadmin\u002Fclass-admin-members.php`).\n2.  **Request Capture:** The handler checks `$_REQUEST['pms_gateway_payment_action']`.\n3.  **URL Extraction:** If the action matches a specific payment gateway (e.g., `paypal_standard` or `paypal_express`), the code extracts a URL or constructs one based on input.\n4.  **The Sink:** The extracted URL is passed to `wp_remote_get()` or `wp_remote_request()` to \"verify\" the transaction with the provider.\n5.  **Missing Check:** The code fails to use `wp_safe_remote_get()` or lacks a whitelist check against the provided URL.\n\n### 4. Nonce Acquisition Strategy\nPayment IPN and callback handlers usually **do not** require nonces because they are designed to receive asynchronous notifications from external servers. If a nonce is required for a front-end AJAX action:\n\n1.  **Identify Shortcode:** The plugin uses `[pms-register]` or `[pms-payment-form]`.\n2.  **Create Page:**\n    ```bash\n    wp post create --post_type=page --post_title=\"Register\" --post_status=publish --post_content='[pms-register]'\n    ```\n3.  **Navigate & Extract:** Use `browser_navigate` to the new page.\n4.  **Extract JS Variable:** The plugin likely localizes data. Based on common PMS patterns, check for `pms_vars` or `pms_front_end_js`.\n    ```javascript\n    \u002F\u002F Use browser_eval\n    window.pms_vars?.nonce || window.pms_front_end_js?.nonce\n    ```\n\n### 5. Exploitation Strategy\nThe goal is to force the server to request an internal resource.\n\n*   **Step 1: Locate the Sink.**\n    Use `grep` in the environment to find where `pms_gateway_payment_action` is handled and if it leads to an HTTP request.\n    ```bash\n    grep -rn \"pms_gateway_payment_action\" .\n    grep -rn \"wp_remote_get\\|wp_remote_post\" .\n    ```\n*   **Step 2: Craft the SSRF Payload.**\n    Assume the vulnerable action is `paypal_ipn_verify` and it accepts a `verify_url` parameter (inferred names).\n*   **Step 3: Execution via `http_request`.**\n    ```json\n    {\n      \"method\": \"POST\",\n      \"url\": \"http:\u002F\u002Flocalhost\u002Fwp-admin\u002Fadmin-ajax.php\",\n      \"headers\": {\n        \"Content-Type\": \"application\u002Fx-www-form-urlencoded\"\n      },\n      \"params\": {\n        \"action\": \"pms_paypal_ipn_verify\",\n        \"verify_url\": \"http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F\"\n      }\n    }\n    ```\n    *Note: If triggered via `init`, send the request to the homepage (`\u002F`) with the parameters.*\n\n### 6. Test Data Setup\n1.  **Activate Plugin:** Ensure `paid-member-subscriptions` is active.\n2.  **Configure Gateway:** Enable \"PayPal Standard\" or \"PayPal Express\" in membership settings to ensure the vulnerable code paths are initialized.\n    ```bash\n    wp option update pms_payments_settings '{\"active_gateways\":[\"paypal_standard\"]}' --format=json\n    ```\n3.  **External Listener:** Use a tool like Webhook.site or a local netcat listener to confirm the outgoing request if testing \"Blind SSRF\".\n\n### 7. Expected Results\n*   **Successful SSRF:** The server response might include the content of the internal resource (if it's a \"Partial SSRF\" that returns body content) OR the attacker's listener receives a request from the WordPress server's IP address.\n*   **Response Indicators:** Look for internal service banners (e.g., \"Redis\", \"HTTP\u002F1.1 200 OK\" from an internal management interface).\n\n### 8. Verification Steps\n1.  **Access Logs:** Check the server access logs or use a collaborator to confirm the request originated from the WP server.\n2.  **Internal Probe:** Attempt to hit `http:\u002F\u002Flocalhost:80` and check if the response contains the WordPress site's own HTML, confirming it can reach its own loopback.\n\n### 9. Alternative Approaches\n*   **Shortcode Vector:** Check if any shortcodes (like `[pms-restrict]`) take a `url` parameter for \"Remote Content\" restriction.\n*   **File Inclusion Check:** If the sink is `file_get_contents()`, attempt to use the `file:\u002F\u002F` wrapper to read `\u002Fetc\u002Fpasswd`.\n*   **Protocol Smuggling:** If `curl` is used, try other protocols like `gopher:\u002F\u002F` to interact with internal services like Memcached or Redis.","gemini-3-flash-preview","2026-07-25 12:03:41","2026-07-25 12:04:45",{"type":34,"vulnerable_version":35,"fixed_version":11,"vulnerable_browse":36,"vulnerable_zip":37,"fixed_browse":38,"fixed_zip":39,"all_tags":40},"plugin","3.0.4","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpaid-member-subscriptions\u002Ftags\u002F3.0.4","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpaid-member-subscriptions.3.0.4.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpaid-member-subscriptions\u002Ftags\u002F3.0.5","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fpaid-member-subscriptions.3.0.5.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fpaid-member-subscriptions\u002Ftags"]