CVE-2026-39645

MediumCVSS 5.4

Published: 08/04/2026(UTC)Updated: 24/07/2026(UTC)Translated: 25/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.17%

6th percentile - higher than 6% of all known CVEs

Summary

The GlobalPayments WooCommerce plugin for WordPress is vulnerable to Server-Side Request Forgery (SSRF). An attacker can send requests from the server to internal or external resources.

Risk Assessment

Risk includes access to internal systems, data leakage, or using the server for attacks on other targets.

Recommendation

Update the GlobalPayments WooCommerce plugin to a version above 1.18.0 as soon as the vendor releases a patch.

Original NVD description (English source)

Server-Side Request Forgery (SSRF) vulnerability in Global Payments GlobalPayments WooCommerce global-payments-woocommerce allows Server Side Request Forgery.This issue affects GlobalPayments WooCommerce: from n/a through <= 1.18.0.