CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
What the vulnerability does
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the import_images() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Explanation of Vulnerability in Simple Terms
The Gutenverse plugin for WordPress contains a server-side request forgery vulnerability that allows authenticated users to make the site send HTTP requests to internal or external systems on the attacker's behalf. An attacker with low-level WordPress access can exploit this without user interaction. The vulnerability affects all versions up to 3.5.3 and may allow information disclosure or manipulation of internal services.
What an attacker can do
Make the site send HTTP requests to internal systems or external URLs to read data or interact with services.
Potential impact on your site
Attackers with basic WordPress access can probe your internal network, read sensitive data from internal services, or trigger unwanted actions on external systems.
Conditions required to exploit
Attacker must have a low-level WordPress user account (subscriber or higher); no user interaction required.
Key dates
External resources
Related vulnerabilities
