Server Side Request Forgery Vulnerability in Getwid – Gutenberg Blocks for WordPress

CVE-2023-1895

What is CVE-2023-1895?

The Getwid – Gutenberg Blocks plugin for WordPress contains a Server Side Request Forgery vulnerability in the get_remote_content REST API endpoint. This allows authenticated attackers with subscriber-level permissions or higher to send crafted web requests to arbitrary external locations from within the web application. As a result, attackers could exploit this flaw to access, manipulate, or exfiltrate sensitive information from internal services, posing a significant security risk.

References