What is the CVSS score of CVE-2026-2948?

CVE-2026-2948 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Gutenverse WordPress Plugin CVE-2026-2948

EUVD-2026-27173 MEDIUM

Server-Side Request Forgery (SSRF) (CWE-918)

2026-05-05 Wordfence

SSRF WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 05, 2026 - 04:31 vuln.today

DescriptionCVE.org

The Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the import_images() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

AnalysisAI

Server-Side Request Forgery in Gutenverse - Ultimate WordPress FSE Blocks Addons & Ecosystem plugin versions up to 3.5.3 allows authenticated contributors and above to initiate arbitrary web requests from the vulnerable server via the import_images() function, enabling query and modification of internal services. The vulnerability is exploitable without user interaction over the network, affecting sites with contributor-level users or higher.

Technical ContextAI

The vulnerability exists in the import_images() function within the Gutenverse WordPress plugin, a Gutenberg block editor extension for creating full-site editing experiences. The SSRF vulnerability (CWE-918) indicates insufficient validation of URLs or request destinations before making server-side HTTP requests. WordPress plugin architecture requires that authenticated users (contributor level and above) have plugin functionality access, making this a privilege-bounded but relatively common attack surface given typical WordPress deployments with multiple content creators. The plugin's image import feature, a common functionality for FSE (Full-Site Editing) block ecosystems, likely processes user-supplied URLs without adequate sanitization or destination validation, allowing attackers to craft requests to internal IP addresses, localhost services, or cloud metadata endpoints.

RemediationAI

Update the Gutenverse plugin to version 3.5.4 or later immediately via the WordPress plugin dashboard (Plugins → Updates) or manually via plugins.trac.wordpress.org. The fix addresses the import_images() function by implementing proper URL validation and request destination filtering. Site administrators should verify the update is applied and test image import functionality post-patch. For sites unable to update immediately, restrict contributor-level user access to the image import feature if possible through role management; however, this is not a reliable workaround and patch application is strongly recommended. Wordfence threat intelligence has documented the vulnerability with specific POC patterns; monitor for exploitation attempts via web application firewall rules or WordPress security plugins that track SSRF request patterns.