CVE-2026-39645

OVERVIEW CVE-2026-39645 is a Server-Side Request Forgery (SSRF) vulnerability in Global Payments' WooCommerce plugin (global-payments-woocommerce) affecting versions 1.18.0 and earlier. This flaw enables attackers to manipulate the affected server into making unauthorized requests to internal or external systems on behalf of the application. SEVERITY The vulnerability carries a CVSS score of 5.4 (Medium) and is exploitable over the network without authentication or user interaction, though it requires high attack complexity. The impact is limited to low-level confidentiality and integrity compromise with no availability impact. The FAUCET Risk Score of 32.0/100 indicates moderate concern relative to comparable vulnerabilities. EXPLOITATION STATUS This vulnerability is not currently being actively exploited in the wild. It does not appear on the CISA Known Exploited Vulnerabilities (KEV) catalog and remains inactive on threat tracking lists. The extremely low EPSS score of 0.00035 suggests minimal likelihood of exploitation in real-world scenarios, indicating this remains a low-priority threat from an active threat perspective. Organizations should prioritize patching based on their WooCommerce deployment footprint rather than imminent exploitation risk.