# CVE-2026-44583: Paymenter SSRF in PayPal webhook endpoint

Source: https://junglewise.ai/threats/cve-2026-44583-paymenter-ssrf-in-paypal-webhook-endpoint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-20. Updated: 2026-07-20  
License: CC BY 4.0 with a link back

CVE-2026-44583 · Severity: medium · CVSS 5.3 · Published 2026-07-20

Paymenter, an open-source platform for managing hosting services and webshops, contains a security flaw in its PayPal payment integration. An attacker can trick the server into making unauthorized web requests to internal or external systems. This could allow an attacker to probe your private internal network or interact with other internal services that are not normally exposed to the internet.

Technologies: [paymenter/paymenter (Packagist)](https://junglewise.ai/threats/technologies/paymenter-paymenter), [Paymenter](https://junglewise.ai/threats/technologies/paymenter). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Paymenter](https://junglewise.ai/threats/vendors/paymenter).

## Quick answers

**Is CVE-2026-44583 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44583 being exploited in the wild.

**How severe is CVE-2026-44583?** Medium severity, with a CVSS score of 5.3, published 20 July 2026.

**Which products and versions are affected?** paymenter/paymenter (Packagist) < 1.5.0, ECOSYSTEM:introduced=0,fixed=1.5.0; Paymenter < 1.5.0.

**Is there a fix for CVE-2026-44583?** Yes. paymenter/paymenter (Packagist): upgrade to 1.5.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44583 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-44583?** Check whether you run paymenter/paymenter (Packagist) or Paymenter at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- paymenter/paymenter (Packagist): upgrade to 1.5.0 or later

  ```sh
  composer require paymenter/paymenter:^1.5.0
  ```


## Technical details

A blind Server-Side Request Forgery (SSRF) vulnerability exists in the PayPal gateway module of Paymenter. The application processes the 'PAYPAL-CERT-URL' HTTP header at the '/extensions/paypal/webhook' endpoint and passes it directly to the PHP 'file_get_contents' function without validation or allowlisting. A remote, unauthenticated attacker can exploit this to induce the server to perform HTTP GET requests to arbitrary internal or external IP addresses. While the attacker does not receive the direct response body, they can use this to probe internal network services or facilitate data exfiltration via side channels. The issue is resolved in version 1.5.0.

## Affected products

- Paymenter Paymenter < 1.5.0

## Identifiers

- CVE-2026-44583
- GHSA-7wwh-xcc3-9fcg

## Timeline

- 2026-06-10: advisory: Original GitHub security advisory published
- 2026-07-20: disclosed: NVD publication date
- 2026-07-20: patched: Fix released in version 1.5.0

## References

- [https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg](https://github.com/Paymenter/Paymenter/security/advisories/GHSA-7wwh-xcc3-9fcg)

## Related threats

- [Paymenter credit refund double-spend race condition in service downgrade](https://junglewise.ai/threats/cve-2026-71537-paymenter-credit-refund-double-spend-race-condition-in-service)
- [Paymenter race condition in credit payment implementation](https://junglewise.ai/threats/cve-2026-55219-paymenter-race-condition-in-credit-payment-implementation)
- [Paymenter input validation bypass in checkout component](https://junglewise.ai/threats/cve-2026-47198-paymenter-input-validation-bypass-in-checkout-component)
- [Paymenter authorization bypass in ticket creation endpoint](https://junglewise.ai/threats/cve-2026-44585-paymenter-authorization-bypass-in-ticket-creation-endpoint)
- [Paymenter insufficient verification of email updates](https://junglewise.ai/threats/cve-2026-44584-paymenter-insufficient-verification-of-email-updates)