What is the CVSS score of EUVD-2026-57907?

EUVD-2026-57907 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of Gutenverse Companion are affected by EUVD-2026-57907?

The Gutenverse Companion WordPress plugin (versions through 2.5.1) contains an unauthenticated Server-Side Request Forgery vulnerability; no public exploit has been identified at time of analysis,…

How to fix or mitigate EUVD-2026-57907?

Within 24 hours, scan your WordPress infrastructure to identify all instances of Gutenverse Companion plugin and document current versions in use; simultaneously disable the plugin on all affected systems if replacement functionality exists or can be substituted. Within 7 days, implement Web Application Firewall (WAF) rules to block HTTP request patterns consistent with SSRF exploitation (e.g., requests to internal IP ranges, localhost, or metadata services) on remaining affected systems if plugin removal is not immediately feasible, and restrict outbound HTTP/HTTPS connectivity from WordPress servers to only approved external destinations via network-layer controls. Within 30 days, monitor Gutenverse security advisories and vendor announcements for patch release; migrate to an alternative plugin if the vendor does not release a patch, or upgrade immediately to any patched version when available.

Gutenverse Companion EUVD-2026-57907

| CVE-2026-66704 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-08-13 Patchstack

GHSA-gm8j-6gpx-2vcr

WordPress SSRF Wordpress Plugin Gutenverse Companion Jegstudio

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Network-accessible, zero-auth SSRF with scope change enabling internal resource access; no availability impact and limited partial C/I align with SSRF class.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:23 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.2

DescriptionCVE.org

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

AnalysisAI

Unauthenticated SSRF in the Gutenverse Companion WordPress plugin (all versions through 2.5.1) allows remote unauthenticated attackers to induce the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a changed scope (S:C) in its CVSS vector, indicating potential for pivoting from the WordPress application layer to backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier makes this broadly exploitable against any unpatched WordPress installation running this plugin.

Technical ContextAI

Gutenverse Companion (CPE: cpe:2.3:a:jegstudio:gutenverse_companion:*:*:*:*:*:*:*:*) is a WordPress plugin developed by jegstudio, serving as a companion to the Gutenverse page-builder ecosystem. CWE-918 (Server-Side Request Forgery) describes the root cause: the plugin accepts user-supplied URLs or host inputs without adequate validation and uses them to construct server-side HTTP requests. This allows the attacker to weaponize the web server as a proxy. The CVSS scope change (S:C) reflects that the impacted resource - internal network services or cloud metadata endpoints - sits outside the WordPress application's own security domain. Common SSRF abuse targets include AWS/GCP/Azure IMDS endpoints (169.254.169.254), internal admin panels, and non-routable services that the WordPress host can reach but the internet cannot.

RemediationAI

The primary remediation is to update the Gutenverse Companion plugin to a version beyond 2.5.1. Upstream fix availability should be confirmed via the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/gutenverse-companion/vulnerability/wordpress-gutenverse-companion-plugin-2-5-1-server-side-request-forgery-ssrf-vulnerability - note that a specific patched release version was not confirmed in the available intelligence data, so administrators should verify the latest release directly on WordPress.org before upgrading. As a compensating control where immediate patching is not feasible, outbound HTTP request filtering at the server or WAF level can restrict the plugin's ability to reach internal RFC-1918 addresses and cloud metadata IP ranges (e.g., 169.254.169.254); this trades some plugin functionality for reduced SSRF blast radius. On cloud-hosted infrastructure, enforcing IMDSv2 (AWS) or equivalent metadata service hardening is a critical secondary control that limits credential theft via SSRF even if the vulnerability is triggered.