PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-39645 Global Payments CVE debrief

A Server-Side Request Forgery (SSRF) vulnerability was identified in the GlobalPayments WooCommerce plugin. This issue, tracked as CVE-2026-39645, allows for Server Side Request Forgery and affects versions from n/a through <= 1.18.0. The vulnerability has a CVSS score of 5.4 and a severity rating of MEDIUM. The vulnerability exists due to inadequate validation of user input, allowing attackers to make unauthorized requests on behalf of the server. This could potentially lead to unauthorized access or data breaches. Users of the GlobalPayments WooCommerce plugin, particularly those with versions from n/a through <= 1.18.0, should be aware of this SSRF vulnerability and take necessary actions to protect their systems. Administrators and security teams responsible for maintaining WooCommerce installations with this plugin should assess their exposure and consider applying necessary updates or mitigations. The Common Vulnerability Scoring System (CVSS) version 3.1 score for this vulnerability is 5.4, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N. Given the MEDIUM severity of this vulnerability, affected users should prioritize patching or mitigating this issue. The vulnerability's CVSS score of 5.4 indicates a moderate level of risk, suggesting that administrators should take action to protect their systems.

Vendor
Global Payments
Product
GlobalPayments WooCommerce
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-08
Original CVE updated
2026-07-24
Advisory published
2026-04-08
Advisory updated
2026-07-24

Who should care

Users of the GlobalPayments WooCommerce plugin, particularly those with versions from n/a through <= 1.18.0, should be aware of this SSRF vulnerability. Given the MEDIUM severity and CVSS score of 5.4, administrators and security teams responsible for maintaining WooCommerce installations with this plugin should assess their exposure and consider applying necessary updates or mitigations.

Technical summary

The GlobalPayments WooCommerce plugin is susceptible to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability, identified as CVE-2026-39645, has been publicly disclosed and affects plugin versions from n/a up to and including 1.18.0. The Common Vulnerability Scoring System (CVSS) version 3.1 score for this vulnerability is 5.4, indicating a MEDIUM severity level. The CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N, which breaks down as follows: Attack Vector (AV) is Network, Attack Complexity (AC) is High, Privileges Required (PR) is None, User Interaction (UI) is None, Scope (S) is Changed, Confidentiality Impact (C) is Low, Integrity Impact (I) is Low, and Availability Impact (A) is None.

Defensive priority

Given the MEDIUM severity of this vulnerability, affected users should prioritize patching or mitigating this issue. The vulnerability's CVSS score of 5.4 indicates a moderate level of risk, suggesting that administrators should take action to protect their systems, especially considering the potential for SSRF attacks to lead to unauthorized access or data breaches.

Recommended defensive actions

  • Review and apply the latest updates for the GlobalPayments WooCommerce plugin, ensuring that versions from n/a through <= 1.18.0 are updated beyond 1.18.0 if available.
  • Implement network-level protections to detect and prevent suspicious traffic that could be indicative of SSRF exploitation attempts.
  • Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses in WooCommerce and related plugins.
  • Consider implementing Web Application Firewalls (WAFs) with rules designed to detect and block SSRF attacks.

Evidence notes

The CVE record for CVE-2026-39645 was published on 2026-04-08T09:16:35.340Z and last modified on 2026-07-24T21:10:00.143Z. The NVD entry for this CVE is currently Deferred. Additional information and potential mitigations can be found through the provided resource links.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-04-08T09:16:35.340Z and has not been modified since then. The NVD entry is currently Deferred.