CVE-2022-45835 MEDIUM

CVE-2022-45835: WordPress PhonePe Payment Solutions Plugin <= 1.0.15 is vulnerable to Server Side Request Forgery (SSRF)

Vendor Phonepe
Product PhonePe Payment Solutions
Weakness CWE-918 · SSRF
Published November 13, 2023
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

5.8/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality Low
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

Server-Side Request Forgery (SSRF) vulnerability in PhonePe PhonePe Payment Solutions.This issue affects PhonePe Payment Solutions: from n/a through 1.0.15.

Explanation of Vulnerability in Simple Terms

02Summary

PhonePe Payment Solutions versions up to 1.0.15 contain a server-side request forgery vulnerability. An attacker can make the payment system send HTTP requests to internal or external systems on the attacker's behalf. No authentication is required. The vulnerability affects the confidentiality of data accessible from the server's network position.

What an attacker can do

03Attacker Capabilities

Make the payment system send requests to internal systems or external servers to read sensitive data.

Potential impact on your site

04Site Impact

Attackers can access internal services, read configuration data, or probe your network without direct access.

Conditions required to exploit

05Prerequisites

Network access to the vulnerable PhonePe Payment Solutions instance; no authentication required.

Key dates

06Disclosure timeline

November 13, 2023 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-55807 Drupal core - Moderately critical - Server-side request forgery - SA-CORE-2026-008 CVE-2026-57407 WordPress PDF Generator for WordPress plugin <= 1.6.2 - Server Side Request Forgery (SSRF) vulnerability CVE-2026-2948 Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl' CVE-2025-60175 WordPress PopAd Plugin <= 1.0.4 - Server Side Request Forgery (SSRF) Vulnerability CVE-2026-3216 Drupal Canvas - Moderately critical - Server-side request forgery, Information disclosure - SA-CONTRIB-2026-017