CVE-2026-2948: Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem <= 3.5.3 - Authenticated (Contributor+) Server-Side Request Forgery via 'imageUrl'
The Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin for WordPress is vulnerable to Server-Side Request Forgery in versions up to, and including, 3.5.3 via the importimages() function. This makes it possible for authenticated attackers, with contributor-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-2948?
The severity of CVE-2026-2948 is classified as high due to the potential for server-side request forgery (SSRF) that can compromise server resources.
How do I fix CVE-2026-2948?
To fix CVE-2026-2948, update the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin to version 3.5.4 or later.
What systems are affected by CVE-2026-2948?
CVE-2026-2948 affects versions up to 3.5.3 of the Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin.
What exploitation methods are possible with CVE-2026-2948?
CVE-2026-2948 allows authenticated users with Contributor+ roles to perform server-side request forgery attacks through the 'imageUrl' parameter.
Is there a known exploit for CVE-2026-2948?
Yes, there are reports of exploitation attempts leveraging CVE-2026-2948, highlighting the urgency for affected users to apply the necessary updates.