CVE-2026-57407 is a Server-Side Request Forgery (SSRF) vulnerability in the WP Swings PDF Generator for WordPress plugin (pdf-generator-for-wp). The issue affects all versions up to and including 1.6.2. SSRF vulnerabilities allow attackers to make the vulnerable server perform HTTP requests to arbitrary domains, potentially leading to information disclosure or other impacts depending on the server's network environment. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed. There is no vendor advisory or patch information currently available, and no known exploits in the wild have been reported.

The vulnerability allows an unauthenticated attacker to cause the server hosting the PDF Generator for WordPress plugin to make arbitrary HTTP requests. This can lead to unauthorized information disclosure and integrity impacts within the server's network context. There is no reported impact on availability. The severity is high based on the CVSS score of 7.2.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.