WordPress PixelYourSite Plugin Blind SSRF Vulnerability

The PixelYourSite Pro – Your smart PIXEL (TAG) Manager plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 12.5.0.1 via the scan_video. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. The SSRF is blind because fetched response bodies are only parsed internally for YouTube/Vimeo patterns and are never returned to the attacker.

Casky was already ahead

This CVE exploits attack patterns that Casky's 312matched skills have been training on — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-7049 exploits a Server-Side Request Forgery (SSRF) flaw in the PixelYourSite Pro plugin for WordPress, affecting all versions up to 12.5.0.1. The vulnerability exists in the scan_video functionality and allows unauthenticated attackers to force the web application to make arbitrary HTTP requests to internal or external targets. Because this is a blind SSRF, attackers cannot directly observe response data, but the vulnerability still enables reconnaissance of internal services, modification of internal data, and potential lateral movement within network infrastructure. Any WordPress installation running this plugin is immediately at risk, as no authentication is required to trigger the vulnerability.

Casky's 312 mapped security skills detect the attack patterns behind this vulnerability by analyzing MITRE ATT&CK techniques TA0001 (Initial Access) and TA0006 (Credential Access). Practitioners using Casky would observe indicators such as: (1) suspicious scan_video requests with unexpected URL parameters pointing to internal IP ranges or localhost services, (2) outbound HTTP connections originating from the WordPress application to non-standard ports or internal infrastructure, and (3) repetitive probing patterns characteristic of SSRF enumeration. Claude's extended reasoning capability correlates these signals across logs to distinguish blind SSRF exploitation attempts from legitimate plugin behavior, flagging requests that attempt to access internal services like databases, metadata endpoints, or cloud provider credentials—even when response bodies aren't directly visible to the attacker.

312 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-7049.

analyzing-cloud-storage-access-patterns

cloud security · low

Run

analyzing-ios-app-security-with-objection

mobile security · low

Run

analyzing-malicious-url-with-urlscan

phishing defense · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0006

Practise detecting this in the Casky Playground

Run Claude AI skills against real targets and see findings like those behind CVE-2026-7049 — before the next CVE drops.

Join the Playground Waitlist →

X Instagram LinkedIn