A critical Server-Side Request Forgery vulnerability in the PixelYourSite Pro WordPress plugin allows unauthenticated attackers to perform unauthorized requests against internal infrastructure.

This flaw is a Server-Side Request Forgery (CWE-918) occurring in the scan_video function. An unauthenticated attacker can force the web application to make requests to arbitrary URLs, enabling the discovery and interaction with internal services that are otherwise inaccessible from the public internet.

Successful exploitation of this vulnerability poses a significant risk to internal network security. Because the application can act as a proxy, an attacker may bypass perimeter firewalls to scan, query, or modify sensitive data within internal services, potentially leading to unauthorized information disclosure or service disruption. With a CVSS score of 7.2, this vulnerability is classified as High severity due to its potential to facilitate lateral movement within the hosting environment.

Immediate Action: Update the PixelYourSite Pro plugin to the latest available version that addresses this vulnerability.

Proactive Monitoring: Monitor server access logs and outbound network traffic for suspicious requests originating from the web server to internal IP addresses or unusual external domains.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to block suspicious outbound requests or restricted access to the vulnerable scan_video endpoint.

Public Exploit Available: No

The high severity of this vulnerability necessitates immediate attention, especially for WordPress installations that reside within secured internal networks. Administrators should verify the current version of the PixelYourSite Pro plugin and apply the latest update provided by the vendor without delay to neutralize the risk of unauthorized internal network access.