CVE-2025-6729

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6729", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-26T14:58:12.466Z", "datePublished": "2025-07-04T01:44:03.082Z", "dateUpdated": "2026-04-08T16:43:42.517Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:42.517Z"}, "affected": [{"vendor": "qazomardok", "product": "PayMaster for WooCommerce", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "0.4.31", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=cve"}, {"url": "https://wordpress.org/plugins/woocommerce-paymaster-gateway-019/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Phong Nguyen"}], "timeline": [{"time": "2025-07-03T12:22:19.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-07-08T14:25:27.401872Z", "id": "CVE-2025-6729", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-08T14:25:36.099Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6729", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-08T14:25:27.401872Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-08T14:25:31.796Z"}}], "cna": {"title": "PayMaster for WooCommerce <= 0.4.31 - Authenticated (Subscriber+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Phong Nguyen"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "qazomardok", "product": "PayMaster for WooCommerce", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "0.4.31"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-03T12:22:19.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=cve"}, {"url": "https://wordpress.org/plugins/woocommerce-paymaster-gateway-019/"}], "descriptions": [{"lang": "en", "value": "The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:42.517Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6729", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:42.517Z", "dateReserved": "2025-06-26T14:58:12.466Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-07-04T01:44:03.082Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "PayMaster for WooCommerce", "vendor": "qazomardok", "versions": [{"lessThanOrEqual": "0.4.31", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:qazomardok:paymaster_for_woocommerce:*:*:*:*:*:wordpress:*:*", "matchCriteriaId": "A24C9963-8F86-453A-9584-410E8C4116E4", "versionEndIncluding": "0.4.31", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The PayMaster for WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 0.4.31 via the 'wp_ajax_paym_status' AJAX action This makes it possible for authenticated attackers, with Subscriber-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El complemento PayMaster para WooCommerce para WordPress es vulnerable a Server Side Request Forgery en todas las versiones hasta la 0.4.31 incluida, a trav\u00e9s de la acci\u00f3n AJAX 'wp_ajax_paym_status'. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, realicen solicitudes web a ubicaciones arbitrarias que se originan en la aplicaci\u00f3n web y pueden usarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-6729", "lastModified": "2026-06-17T10:02:27.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6729", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-07-08T14:25:27.401872Z", "version": "2.0.3"}}]}, "published": "2025-07-04T03:15:22.577", "references": [{"source": "security@wordfence.com", "tags": ["Product"], "url": "https://wordpress.org/plugins/woocommerce-paymaster-gateway-019/"}, {"source": "security@wordfence.com", "tags": ["Third Party Advisory"], "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T14:43:10.519273+00:00", "value": {"mitigation_remediation": ["Upgrade the PayMaster for WooCommerce plugin to at least version 0.4.32, which removes the SSRF flaw.", "If an immediate upgrade is not possible, restrict the wp_ajax_paym_status AJAX action so that only users with administrator capability can execute it, thereby blocking lower\u2011privilege users from exploiting the SSRF.", "Continuously monitor outbound requests originating from the web application for unexpected internal service calls to detect and respond to any attempts to abuse this vulnerability."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery allowing authenticated subscribers to direct the site to arbitrary internal resources"}, "threat_synthesis": {"affected_systems": "WordPress sites running the PayMaster for WooCommerce plugin by qazomardok, any installed version up to and including 0.4.31.", "description_and_impact": "The vulnerability is a Server\u2011Side Request Forgery flaw that enables authenticated users with Subscriber or higher privileges to trigger web requests to arbitrary URLs from the WordPress application. This can expose sensitive internal services or be used to modify internal data. The weakness is mapped to CWE\u2011918.", "risk_and_exploitability": "The reported CVSS score of 6.4 indicates moderate severity, while an EPSS score of less than 1% suggests a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. Attackers must be authenticated with at least Subscriber level, implying potential insider threat or compromised accounts as the prerequisite."}}}}, "created": "2026-04-22T14:45:19.294359+00:00", "updated": "2026-04-22T14:45:19.294382+00:00", "vendors": []}