PT-2025-27849 · WordPress · Paymaster For Woocommerce

Phong Nguyen · Published 2025-07-04 · Updated 2025-07-19 · CVE-2025-6729

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31

Description: The issue allows authenticated attackers with Subscriber-level access and above to make web requests to arbitrary locations originating from the web application. This can be used to query and modify information from internal services via the wp ajax paym status AJAX action.

Recommendations: For PayMaster for WooCommerce plugin for WordPress versions up to, and including, 0.4.31, consider disabling the wp ajax paym status AJAX action as a temporary workaround until a patch is available. Restrict access to this action to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2025-6729

Affected Products

Paymaster For Woocommerce

References · 7

• https://osv.dev/vulnerability/CVE-2025-6729 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-6729 · Security Note
• https://wordpress.org/plugins/woocommerce-paymaster-gateway-019 · Note
• https://twitter.com/VulmonFeeds/status/1941006146296316375 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/2b9b501e-2ce7-43d8-bad2-6c3176eed8e2?source=cve · Note
• https://t.me/cvenotify/127688 · Telegram Post
• https://twitter.com/jmdevlabs/status/1946652989936083210 · Twitter Post