CVE-2026-2948
MEDIUM
NVD
CVSS Score
6.4
Severity
MEDIUM
Published
May 05, 2026
Vendor
unknown
Description
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the import_images() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.