Gutenverse Companion
Monthly
Unauthenticated SSRF in the Gutenverse Companion WordPress plugin (all versions through 2.5.1) allows remote unauthenticated attackers to induce the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a changed scope (S:C) in its CVSS vector, indicating potential for pivoting from the WordPress application layer to backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier makes this broadly exploitable against any unpatched WordPress installation running this plugin.
Unauthenticated SSRF in the Gutenverse Companion WordPress plugin (all versions through 2.5.1) allows remote unauthenticated attackers to induce the server to issue arbitrary HTTP requests to internal or external targets. The vulnerability carries a changed scope (S:C) in its CVSS vector, indicating potential for pivoting from the WordPress application layer to backend infrastructure. No public exploit code or CISA KEV listing has been identified at time of analysis, but the zero-authentication barrier makes this broadly exploitable against any unpatched WordPress installation running this plugin.