CVE-2023-1895: The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in...
8.5
CVSS
Description
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Classification
CVE ID: CVE-2023-1895
CVSS Base Severity: HIGH
CVSS Base Score: 8.5
Affected Products
Vendor: jetmonsters
Product: Getwid – Gutenberg Blocks
Exploit Prediction Scoring System (EPSS)
EPSS Score: 0.08% (probability of being exploited)
EPSS Percentile: 37.21% (scored less or equal to compared to others)
EPSS Date: 2025-02-03 (when was this score calculated)
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cvehttps://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php