The PayMaster for WooCommerce plugin for WordPress contains a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2025-6729. This vulnerability exists in all versions up to and including 0.4.31 and can be triggered through the 'wp_ajax_paym_status' AJAX action. An attacker with at least Subscriber-level privileges can abuse this flaw to make the server perform HTTP requests to arbitrary locations, potentially accessing or modifying internal service data. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction. No patch or official fix information is currently available, and no known exploits have been reported.

Successful exploitation allows an authenticated user with Subscriber-level access or higher to cause the server to make arbitrary HTTP requests. This can lead to unauthorized querying and modification of internal services accessible from the server, potentially exposing sensitive internal information or altering internal data. The impact includes limited confidentiality and integrity loss but no availability impact is indicated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict user privileges carefully to prevent untrusted users from having Subscriber-level access or higher. Monitor for updates from the vendor regarding patches or official mitigations. Avoid exposing internal services that could be accessed via SSRF from the affected server.