CVE-2026-7049 is a Server-Side Request Forgery (SSRF) vulnerability affecting PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress in versions up to 12.5.0.1. The flaw exists in the scan_video functionality, enabling unauthenticated attackers to induce the server to make arbitrary HTTP requests to internal or external systems. The SSRF is blind, as the plugin only internally parses response bodies for YouTube/Vimeo patterns without returning data to the attacker. This can potentially allow attackers to query or modify information from internal services accessible to the web application.

An unauthenticated attacker can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests, potentially accessing or modifying internal services that are not directly reachable externally. Although the response content is not returned to the attacker, the ability to interact with internal resources can lead to information disclosure or further attacks within the internal network. The CVSS score of 7.2 reflects a high severity impact with low attack complexity and no required privileges or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is currently available. Until a patch is released, users should consider disabling or restricting the scan_video functionality if possible and monitor for updates from the vendor. Applying network-level controls to limit the web server's ability to make arbitrary outbound requests may also reduce risk.