CVE-2026-7049: PixelYourSite Pro <= 12.5.0.1 - Unauthenticated Blind Server-Side Request Forgery via 'urls[]' Parameter
The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scanvideo. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The SSRF is blind because fetched response bodies are only parsed internally for YouTube/Vimeo patterns and are never returned to the attacker.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-7049?
CVE-2026-7049 is rated as a high severity vulnerability due to its potential for unauthenticated Server-Side Request Forgery.
How do I fix CVE-2026-7049?
To fix CVE-2026-7049, update PixelYourSite Pro to version 12.5.0.2 or later.
Who is affected by CVE-2026-7049?
CVE-2026-7049 affects all versions of PixelYourSite Pro up to and including version 12.5.0.1.
What type of vulnerability is CVE-2026-7049?
CVE-2026-7049 is classified as an Unauthenticated Blind Server-Side Request Forgery (SSRF).
What systems are impacted by CVE-2026-7049?
CVE-2026-7049 impacts WordPress sites using the PixelYourSite Pro plugin prior to version 12.5.0.2.