CVE-2026-44583 Details
Description
Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the PayPal webhook endpoint /extensions/paypal/webhook processes the PAYPAL-CERT-URL HTTP header without validation, allowing attackers to control server-side HTTP request destinations. This value is passed directly into a server-side HTTP request via file_get_contents, allowing attackers to control the destination of the request. No allowlist, validation, or signature verification is applied to the header before usage. As a result, the application can be coerced into performing HTTP requests to attacker-controlled or internal network destinations. This vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal endpoints. Depending on network configuration, this may lead to: blind SSRF to external attacker-controlled systems, and potential access to internal network services No direct response data is returned to the attacker (blind SSRF), but the issue may still enable sensitive network probing or data exfiltration via side channels. This issue has been fixed in version 1.5.0.
A blind server-side request forgery (SSRF) vulnerability has been identified in Paymenter, a free and open-source webshop solution for managing hosting services. This issue affects versions prior to 1.5.0. The vulnerability arises in the PayPal webhook endpoint '/extensions/paypal/webhook', which processes the 'PAYPAL-CERT-URL' HTTP header without proper validation. As a result, attackers can manipulate server-side HTTP request destinations. The unvalidated header value is directly used in a server-side HTTP request via 'file_get_contents', enabling requests to attacker-controlled or internal network endpoints. The vulnerability allows remote unauthenticated attackers to induce server-side HTTP GET requests to arbitrary external or internal destinations. Depending on the network configuration, this could lead to blind SSRF to external attacker-controlled systems or potential access to internal network services. While no direct response data is returned to the attacker due to the blind nature of the SSRF, the vulnerability could still facilitate sensitive network probing or data exfiltration through side channels.
Users can upgrade to Paymenter version 1.5.0 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 20, 2026CISA-ADP
Assessed Jul 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-918 | Server-Side Request Forgery (SSRF) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Paymenter | < 1.4.7 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 21, 2026 | CVE Modified | CISA-ADP |
| Jul 20, 2026 | New CVE Received | [email protected] |