CVE-2026-7049 describes a Server-Side Request Forgery (SSRF) vulnerability in the PixelYourSite Pro WordPress plugin affecting all versions up to and including 12.5.0.1. The flaw exists in the scan_video feature, which allows unauthenticated attackers to induce the server to make HTTP requests to arbitrary locations. The SSRF is blind because the server processes response bodies internally without returning them to the attacker, limiting direct data exfiltration but still enabling interaction with internal services. The vulnerability is categorized under CWE-918 and has a CVSS v3.1 score of 7.2 (high severity). No official patch or remediation guidance is currently provided by the vendor.

An unauthenticated attacker can leverage this SSRF vulnerability to make the server perform arbitrary HTTP requests, potentially accessing or modifying internal services that are not directly accessible externally. Although the SSRF is blind and does not return response data to the attacker, it can still be used to probe internal network resources or influence internal application behavior. There is no indication of direct data exfiltration or denial of service from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch is currently documented, users should monitor the vendor's communications for updates. Until a patch is available, consider restricting network access from the web server to internal services where possible to limit SSRF impact.