What’s Vulnerable › Vulnerabilities

CVE-2023-1895: Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery

• Severity: critical (CVSS 9.6 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-06-09 · updated 2026-06-17
• Weakness: CWE-918

Description

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected products

• jetmonsters Getwid – Gutenberg Blocks: through 1.8.3

References

• https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php
• https://www.wordfence.com/blog/2023/06/credential-stealing-server-side-request-forgery-patched-in-getwid/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cve
• https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cve

Get alerted when CVE-2023-1895 or the next vulnerability affects your stack