What is the CVSS score of EUVD-2026-29405?

EUVD-2026-29405 has a CVSS 3.1 base score of 4.8 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

GWD Connect WordPress Plugin EUVD-2026-29405

| CVE-2026-6663 MEDIUM

Missing Authorization (CWE-862)

2026-05-12 Wordfence

GHSA-v3cp-rrhp-98mx

Authentication Bypass PHP RCE WordPress

4.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.8 MEDIUM

AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 12, 2026 - 08:47 vuln.today

CVE Published

May 12, 2026 - 07:48 nvd

MEDIUM 4.8

DescriptionCVE.org

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.

AnalysisAI

Unauthenticated remote code execution in GWD Connect WordPress plugin versions up to 2.9 allows attackers to execute arbitrary PHP code on unregistered installations via the update_agent action in standalone agent endpoints (gwd-backup.php and gwd-logs.php) when the API key is not configured. The vulnerability exploits a missing authorization check that occurs only when the authentication key has not been set up, affecting default installations. No public exploit code or active exploitation has been confirmed at this time.

Technical ContextAI

The GWD Connect plugin provides standalone agent endpoints (gwd-backup.php and gwd-logs.php) that are designed to handle backup and logging operations independently of the main WordPress installation. These endpoints implement an update_agent action that accepts PHP code and writes it to an agent file on the server. The vulnerability stems from CWE-862 (Missing Authorization) - the plugin fails to verify whether a request is authorized before processing the update_agent action when no API key has been configured. In default installations, this means the authentication mechanism is entirely bypassed. The affected product is tracked in CPE as cpe:2.3:a:thewebsistesupply:gwd_conex (note: the vendor identifier in the CPE and the plugin name may have variations), and affects all versions up to and including 2.9.

RemediationAI

The primary remediation is to upgrade to GWD Connect version 2.10 or later, which should include authorization checks for the standalone agent endpoints. Until an upgrade is available, administrators should immediately configure an API key in the plugin settings, which activates the authentication mechanism and prevents the bypass described in CVE-2026-6663. A secondary control is to restrict direct access to gwd-backup.php and gwd-logs.php files via web server configuration (e.g., Apache .htaccess or nginx location block) by blocking HTTP requests to these files or requiring IP whitelisting. This approach mitigates the vulnerability but may break legitimate backup and logging functionality if the agent endpoints are in use. Additionally, remove or rename the gwd-backup.php and gwd-logs.php files if the standalone agent functionality is not required. For defense-in-depth, implement file integrity monitoring on the agent PHP files to detect unauthorized modifications, and review server logs for POST requests to these endpoints from unexpected IP addresses. Refer to the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2d435f-d6ce-41bd-8a45-e252fb4ba419 for vendor guidance.