{
 "id": "WPSEC-2026-2955",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2955/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2955/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2955/index.md",
 "title": "QA Assistants <= 5.3.0.2 - Unauthenticated Server-Side Request Forgery via Tracked Page URL",
 "description": "The QA Assistants plugin for WordPress is vulnerable to Server-Side Request Forgery via the tracked page URL in all versions up to, and including, 5.3.0.2. This is due to the public tracking endpoint (qahm-ajax.php) accepting any page URL without checking it against the registered sites. The plugin later fetches that stored URL with wp_remote_get() (or cURL), following redirects, when it builds replay, heatmap and page-HTML data. This makes it possible for unauthenticated attackers to make the web server send requests to arbitrary locations, including internal services. The responses are saved and shown in the plugin's analytics views.",
 "plugin": {
  "slug": "qa-heatmap-analytics",
  "name": "QA Assistants",
  "full_name": "QA Assistants – Driven by data",
  "wordpress_org": "https://wordpress.org/plugins/qa-heatmap-analytics/",
  "advisories_url": "https://wpsec.com/vuln/plugin/qa-heatmap-analytics/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.0.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.0.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.0.3",
 "remediation": "Update to 5.3.0.3 or later.",
 "fix_released": "2026-11-10T02:52:07+00:00",
 "published": "2026-11-12T17:52:14+00:00",
 "updated": "2026-11-12T17:11:36.371374+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2955/",
  "https://plugins.svn.wordpress.org/qa-heatmap-analytics/tags/5.3.0.3/",
  "https://wordpress.org/plugins/qa-heatmap-analytics/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/qa-heatmap-analytics",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-12"
 }
}