PixelYourSite Pro Plugin SSRF Vulnerability (CVE-2026-7049)

The PixelYourSite Pro plugin for WordPress, a popular tag manager, is vulnerable to a high-severity Server-Side Request Forgery (SSRF) flaw, identified as CVE-2026-7049. The National Vulnerability Database reports this affects all plugin versions up to and including 12.5.0.1. The vulnerability resides in the scan_video function, allowing unauthenticated attackers to initiate web requests from the compromised WordPress application to arbitrary internal or external locations.

This SSRF is blind, meaning the fetched response bodies are not directly returned to the attacker. Instead, the plugin internally parses them for YouTube/Vimeo patterns. Despite being blind, this vulnerability still poses a significant risk. Attackers can leverage it to query and potentially modify information from internal services, map internal networks, or trigger actions on other systems accessible from the web server. The CVSS score of 7.2 (HIGH) reflects the broad attack vector (network-exploitable, no privileges, no user interaction) and the high impact on confidentiality and integrity, even if indirectly.

For defenders, this means any WordPress site running PixelYourSite Pro is a potential pivot point. The attacker’s calculus here is clear: blind SSRF is a valuable foothold. It allows reconnaissance of internal infrastructure and can bypass perimeter defenses by using the web server as an unwitting proxy. Even without direct data exfiltration, the ability to interact with internal services can lead to further compromise or data manipulation.