CVE-2025-6729: PayMaster for WooCommerce SSRF Vulnerability

CVE-2025-6729 Overview

CVE-2025-6729 is a Server-Side Request Forgery (SSRF) vulnerability in the PayMaster for WooCommerce plugin for WordPress. The flaw affects all versions up to and including 0.4.31 through the wp_ajax_paym_status AJAX action. Authenticated attackers with Subscriber-level access or above can issue web requests to arbitrary locations from the vulnerable WordPress server. The issue is tracked as CWE-918: Server-Side Request Forgery.

Critical Impact
Authenticated attackers can abuse the WordPress server to query and modify information on internal services reachable from the host, including cloud metadata endpoints and internal APIs.

Affected Products

Qazomardok PayMaster for WooCommerce plugin, all versions through 0.4.31
WordPress sites running the plugin with Subscriber-level accounts or higher enabled
WooCommerce deployments integrating the PayMaster payment gateway

Discovery Timeline

2025-07-04 - CVE-2025-6729 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-6729

Vulnerability Analysis

The PayMaster for WooCommerce plugin registers the wp_ajax_paym_status AJAX action to check payment status. The handler accepts a user-controlled URL or identifier and performs an outbound HTTP request without validating the destination. Because the action is bound to wp_ajax_ without a nonce or capability check that restricts low-privilege roles, any authenticated user, including Subscribers, can invoke it.

The plugin passes attacker-controlled input directly into a server-side HTTP client. The server retrieves the response and may expose it back to the attacker or trigger side effects on the target. This enables access to internal network resources that are normally isolated from the public internet.

Root Cause

The root cause is missing input validation and insufficient authorization on the wp_ajax_paym_status endpoint. The plugin trusts the destination URL supplied by the authenticated caller and does not enforce an allow-list of hosts or schemes. This matches the classic [CWE-918] pattern where user input directly controls the target of a server-initiated request.

Attack Vector

An attacker first obtains any authenticated role at or above Subscriber, which is the default role for new WordPress registrations when open registration is enabled. The attacker then submits a crafted POST request to /wp-admin/admin-ajax.php with action=paym_status and a controlled URL parameter. The WordPress server issues the outbound request to the specified target, which can be an internal IP address, a cloud metadata service such as 169.254.169.254, or a loopback administrative interface.

The vulnerability is described in prose because no verified proof-of-concept code has been published. Technical details are available in the Wordfence Vulnerability Report and the WordPress Plugin Details page.

Detection Methods for CVE-2025-6729

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php carrying action=paym_status from low-privilege authenticated sessions
Outbound HTTP requests from the WordPress host to RFC1918 ranges, 127.0.0.1, or 169.254.169.254
Unexpected new Subscriber-level accounts created shortly before AJAX activity targeting paym_status
Access log entries where the paym_status action is invoked with URL-like parameters that reference internal hostnames

Detection Strategies

Inspect WordPress access logs and web application firewall telemetry for the paym_status action invoked by non-administrative users
Correlate authenticated session identifiers with outbound connection logs on the WordPress host to detect SSRF chaining
Alert on PHP process network connections to cloud metadata endpoints or private address space

Monitoring Recommendations

Enable egress logging on the WordPress server and route denials to a SIEM for review
Monitor WordPress user registration events and flag bursts of Subscriber account creation
Track plugin version inventory and alert when paymaster_for_woocommerce versions at or below 0.4.31 remain in production

How to Mitigate CVE-2025-6729

Immediate Actions Required

Disable the PayMaster for WooCommerce plugin on all WordPress sites until a fixed version is confirmed and deployed
Disable open user registration or restrict the default role so that unauthenticated visitors cannot acquire Subscriber access
Audit existing Subscriber-level accounts and remove any that cannot be attributed to a legitimate customer
Review web server logs for prior invocations of the paym_status AJAX action and investigate any outbound requests to internal addresses

Patch Information

No vendor patch is referenced in the available advisory data at the time of writing. Administrators should monitor the WordPress plugin page and the Wordfence advisory for a release above version 0.4.31 that addresses the SSRF flaw.

Workarounds

Block requests to admin-ajax.php where the action parameter equals paym_status using a web application firewall rule
Restrict outbound traffic from the WordPress server with a host firewall that denies connections to RFC1918 ranges, loopback, and cloud metadata endpoints
Require Instance Metadata Service Version 2 (IMDSv2) on AWS workloads to blunt metadata credential theft via SSRF
Remove the plugin and migrate to a maintained payment gateway integration if a fix is not released promptly

bash

# Example WAF rule concept to block the vulnerable AJAX action
# ModSecurity-style pseudo-rule
SecRule REQUEST_URI "@endsWith /wp-admin/admin-ajax.php" \
  "chain,phase:2,deny,status:403,id:1006729,msg:'Block CVE-2025-6729 paym_status SSRF'"
  SecRule ARGS:action "@streq paym_status"