Is CVE-2026-44583 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-44583 being exploited in the wild.

How severe is CVE-2026-44583?

Medium severity, with a CVSS score of 5.3, published 20 July 2026.

Which products and versions are affected?

paymenter/paymenter (Packagist) < 1.5.0, ECOSYSTEM:introduced=0,fixed=1.5.0; Paymenter < 1.5.0.

Is there a fix for CVE-2026-44583?

Yes. paymenter/paymenter (Packagist): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-44583 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-44583?

Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44583: Paymenter SSRF in PayPal webhook endpoint

Q: Is there a fix for CVE-2026-44583?

Yes. paymenter/paymenter (Packagist): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-44583 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-44583?

Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-44583 · Severity: medium · CVSS 5.3 · Published 2026-07-20

Paymenter, an open-source platform for managing hosting services and webshops, contains a security flaw in its PayPal payment integration. An attacker can trick the server into making unauthorized web requests to internal or external systems. This could allow an attacker to probe your private internal network or interact with other internal services that are not normally exposed to the internet.

Technologies: paymenter/paymenter (Packagist), Paymenter. Vendors: Packagist, Paymenter.

Quick answers

Is CVE-2026-44583 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-44583 being exploited in the wild.
How severe is CVE-2026-44583?: Medium severity, with a CVSS score of 5.3, published 20 July 2026.
Which products and versions are affected?: paymenter/paymenter (Packagist) < 1.5.0, ECOSYSTEM:introduced=0,fixed=1.5.0; Paymenter < 1.5.0.
Is there a fix for CVE-2026-44583?: Yes. paymenter/paymenter (Packagist): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44583 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-44583?: Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

paymenter/paymenter (Packagist): upgrade to 1.5.0 or later
```
composer require paymenter/paymenter:^1.5.0
```

Technical details

A blind Server-Side Request Forgery (SSRF) vulnerability exists in the PayPal gateway module of Paymenter. The application processes the 'PAYPAL-CERT-URL' HTTP header at the '/extensions/paypal/webhook' endpoint and passes it directly to the PHP 'file_get_contents' function without validation or allowlisting. A remote, unauthenticated attacker can exploit this to induce the server to perform HTTP GET requests to arbitrary internal or external IP addresses. While the attacker does not receive the direct response body, they can use this to probe internal network services or facilitate data exfiltration via side channels. The issue is resolved in version 1.5.0.

Affected products

Paymenter Paymenter < 1.5.0

Identifiers

CVE-2026-44583
GHSA-7wwh-xcc3-9fcg

Timeline

2026-06-10: advisory: Original GitHub security advisory published
2026-07-20: disclosed: NVD publication date
2026-07-20: patched: Fix released in version 1.5.0

References

https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.