This vulnerability (CVE-2026-57348) is classified as CWE-918 (Server-Side Request Forgery) and affects Cozmoslabs Paid Member Subscriptions plugin versions up to 3.0.4. It allows unauthenticated attackers to trigger SSRF, enabling them to make the server perform arbitrary requests. The CVSS 3.1 base score is 7.2 (high), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, scope changed, and impacts on confidentiality and integrity but not availability. No official patch or remediation guidance is currently provided, and no known exploits in the wild have been reported.

An unauthenticated attacker can exploit this SSRF vulnerability to make the affected server send crafted requests to internal or external resources. This can lead to partial loss of confidentiality and integrity of data accessible by the server. There is no reported impact on availability. The vulnerability does not require authentication or user interaction, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor vendor communications for updates. Avoid exposing the affected plugin to untrusted networks or inputs that could be used to trigger SSRF. No official remediation or temporary fix is currently documented.