Is CVE-2026-57372 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57372 being exploited in the wild.

How severe is CVE-2026-57372?

High severity, with a CVSS score of 7.2, published 13 July 2026.

Is there a fix for CVE-2026-57372?

A patch was published on 2026-07-07: Version 7.0.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57372 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57372?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57372: denishua WPJAM Basic SSRF in WordPress plugin

CVE-2026-57372 · Severity: high · CVSS 7.2 · Published 2026-07-13

WPJAM Basic, a popular WordPress optimization plugin, is vulnerable to a security flaw that allows unauthorized requests to be sent from the web server. An attacker could exploit this to probe internal network services that are not normally accessible from the internet or to mask the origin of malicious traffic. This could lead to the exposure of sensitive internal data or unauthorized access to other systems within the corporate network.

Quick answers

Is CVE-2026-57372 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57372 being exploited in the wild.
How severe is CVE-2026-57372?: High severity, with a CVSS score of 7.2, published 13 July 2026.
Which products and versions are affected?: denishua WPJAM Basic <= 7.0.
Is there a fix for CVE-2026-57372?: A patch was published on 2026-07-07: Version 7.0.1 released to address the vulnerability Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57372 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57372?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Server-Side Request Forgery (SSRF) vulnerability exists in the denishua WPJAM Basic plugin for WordPress (versions <= 7.0). The vulnerability (CWE-918) allows an unauthenticated remote attacker to induce the server to make requests to arbitrary domains or internal network resources. This occurs due to insufficient validation of user-supplied URLs before the plugin performs a server-side request. Attackers can leverage this to bypass firewalls, scan internal networks, or access metadata services in cloud environments. The issue is resolved in version 7.0.1.

Affected products

denishua WPJAM Basic <= 7.0

Timeline

2026-04-30: disclosed: Reported by she11f to Patchstack
2026-07-07: advisory: Patchstack published advisory
2026-07-13: advisory: NVD published CVE record
2026-07-07: patched: Version 7.0.1 released to address the vulnerability

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.