PT-2026-36962 · WordPress · Gutenverse

Published 2026-05-05 · Updated 2026-05-05 · CVE-2026-2948

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem versions prior to 3.5.4

Description An issue exists where authenticated attackers with contributor-level access and above can perform Server-Side Request Forgery (SSRF), which is a flaw allowing a server to be coerced into making requests to an unintended location. This is possible through the import images() function, enabling attackers to make web requests to arbitrary locations from the web application to query or modify information from internal services.

Recommendations Update to a version later than 3.5.3. As a temporary workaround, restrict access to the import images() function to minimize the risk of exploitation.

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2026-2948

Affected Products

Gutenverse

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-2948 · Security Note
• https://twitter.com/CVEarity/status/2051606651808170084 · Twitter Post
• https://t.me/CVEtracker/52704 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3507804/gutenverse · Note
• https://twitter.com/VulmonFeeds/status/2051590522918130166 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/ac909a4b-d949-42eb-871a-963bc6242c12?source=cve · Note
• https://t.me/cveNotify/162129 · Telegram Post