CVE-2026-57372: WPJAM Basic SSRF Vulnerability

CVE-2026-57372 Overview

CVE-2026-57372 is a Server-Side Request Forgery (SSRF) vulnerability affecting the WPJAM Basic WordPress plugin developed by denishua. The flaw impacts all versions of wpjam-basic up to and including version 7.0. Classified under [CWE-918], the vulnerability allows a remote unauthenticated attacker to induce the WordPress server to issue arbitrary HTTP requests to internal or external systems. Successful exploitation can expose internal services, cloud metadata endpoints, or other resources not intended to be reachable from the public network.

Critical Impact
Unauthenticated attackers can coerce vulnerable WPJAM Basic installations to send crafted HTTP requests to attacker-chosen destinations, enabling reconnaissance of internal networks and access to restricted services.

Affected Products

WPJAM Basic plugin for WordPress (wpjam-basic)
All versions from n/a through 7.0
WordPress sites running the denishua WPJAM Basic extension

Discovery Timeline

2026-07-13 - CVE-2026-57372 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-57372

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) issue [CWE-918] within the WPJAM Basic plugin. The plugin accepts a user-controlled URL and dispatches an HTTP request from the WordPress server without sufficient validation of the target destination. This allows an attacker to redirect the server-initiated request to arbitrary hosts and ports.

Attackers can leverage this behavior to probe internal network segments, reach services bound to localhost, or interact with cloud instance metadata endpoints such as 169.254.169.254. The attack requires no authentication and no user interaction. The scope is changed, meaning the vulnerable component can affect resources beyond its own security authority.

EPSS data records a probability of 0.194% at the 9.334 percentile, indicating limited observed exploitation attempts at the time of publication.

Root Cause

The root cause is missing or insufficient validation of URL inputs passed to server-side HTTP request functions within wpjam-basic. The plugin does not enforce an allowlist of destinations, block private IP ranges, or restrict URL schemes before performing the outbound fetch.

Attack Vector

An unauthenticated attacker sends a crafted request to a vulnerable WPJAM Basic endpoint containing a URL parameter pointing to an internal resource. The WordPress server processes the request and issues an HTTP call to the attacker-supplied destination. The response, or side effects of the request, can reveal internal service banners, metadata credentials, or configuration data. Technical details are available in the Patchstack WordPress Plugin Vulnerability advisory.

Detection Methods for CVE-2026-57372

Indicators of Compromise

Outbound HTTP requests from the WordPress server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16
Requests originating from PHP-FPM or the web server process targeting cloud metadata endpoints like 169.254.169.254
Unexpected entries in web server access logs containing URL parameters referencing localhost, 127.0.0.1, or file:// schemes
Repeated requests to WPJAM Basic plugin endpoints with URL-encoded destinations in query strings or POST bodies

Detection Strategies

Inspect WordPress and web server logs for anomalous request patterns targeting wpjam-basic endpoints with user-supplied URLs
Deploy web application firewall rules that flag requests containing internal IP literals or metadata service hostnames in parameter values
Correlate outbound connections from web servers with inbound HTTP requests to identify SSRF chains

Monitoring Recommendations

Enable network flow logging on WordPress hosts and alert on egress traffic to RFC1918 addresses or link-local ranges
Monitor cloud audit logs for unusual instance metadata API calls originating from web-facing workloads
Track WordPress plugin version inventories and alert when wpjam-basic version 7.0 or earlier is observed

How to Mitigate CVE-2026-57372

Immediate Actions Required

Identify all WordPress installations using the WPJAM Basic plugin and confirm the installed version
Restrict outbound network access from WordPress servers to only required destinations at the firewall or security group level
Block access to cloud metadata endpoints from the WordPress workload where feasible
Apply web application firewall rules to filter suspicious URL parameters submitted to plugin endpoints

Patch Information

At the time of publication, no fixed version beyond 7.0 is referenced in the advisory. Monitor the Patchstack advisory and the plugin repository for a security release addressing CVE-2026-57372, and apply the patched version as soon as it becomes available.

Workarounds

Deactivate and remove the WPJAM Basic plugin until a patched release is available
Enforce egress filtering that denies WordPress hosts from initiating connections to internal networks and metadata services
Configure PHP allow_url_fopen and outbound HTTP libraries to reject private address ranges via a proxy allowlist
Require Instance Metadata Service Version 2 (IMDSv2) on AWS workloads to reduce the impact of SSRF against metadata endpoints

bash

# Example nginx rule to block requests containing internal IP literals in query strings
if ($args ~* "(127\.0\.0\.1|localhost|169\.254\.169\.254|10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)") {
    return 403;
}