Description

Unauthenticated Server Side Request Forgery (SSRF) in Gutenverse Companion <= 2.5.1 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-08-13T14:17:11.043Z",
  "pubdate": "2026-08-13T14:17:11.043Z",
  "executiveSummary": "An unauthenticated Server-Side Request Forgery (SSRF) vulnerability has been identified in the Gutenverse Companion plugin, specifically affecting versions <= 2.5.1. This security flaw enables remote, unauthenticated attackers to induce the vulnerable WordPress server into initiating arbitrary HTTP requests toward internal or external destinations. By abusing this functionality, malicious actors can bypass network perimeters, interact with internal services that are otherwise inaccessible from the public internet, extract sensitive configuration data, or leverage the host server as a proxy for conducting further network-based attacks. The vulnerability carries significant risk implications as it requires no prior authentication or specialized privileges, lowering the barrier to exploitation. Mitigation requires updating the Gutenverse Companion plugin to a patched version beyond 2.5.1 as soon as security updates become available, alongside implementing robust network egress filtering and validation of URLs handled by server-side request mechanisms.",
  "technicalDetails": "The vulnerability resides within the request-handling mechanisms of the Gutenverse Companion plugin for WordPress, impacting versions 2.5.1 and prior. The root cause stems from insufficient validation, sanitization, and restriction of user-supplied URLs passed to backend HTTP request functions. Because the application blindly trusts and processes parameters dictating outbound network connections without enforcing an allowlist or properly restricting destinations to safe, external domains, the component becomes susceptible to Server-Side Request Forgery.\nExploitation of this vulnerability is unauthenticated and requires no user interaction or privileged access levels. An attacker with network exposure to the WordPress installation can craft a malicious HTTP request targeting the vulnerable endpoint exposed by the plugin. By supplying a specially crafted payload within the request parameter—such as an internal IP address (e.g., 127.0.0.1 or local network ranges), internal service ports, or custom URI schemes like file:// or gopher:// where supported by the underlying PHP cURL or HTTP request libraries—the attacker forces the server to initiate the connection on their behalf.\nThe attack flow proceeds as follows: First, the unauthenticated attacker transmits the malicious payload to the vulnerable endpoint within the Gutenverse Companion plugin. Second, the plugin parses the input without validating whether the target URL points to a prohibited internal resource. Third, the underlying server-side HTTP client executes the request, dispatching packets from the local network interface of the WordPress host toward the targeted internal or external destination. Fourth, depending on the application logic, the response data from the internal resource may be reflected back to the attacker, or the side effects of the request (such as port scanning, interaction with cloud metadata services, or triggering internal application APIs) are realized.\nThe post-exploitation impact includes unauthorized access to internal microservices, administrative interfaces, database endpoints, or cloud provider metadata services (e.g., AWS IMDS), potentially leading to credential theft, Remote Code Execution (RCE) via chained vulnerabilities, or severe internal reconnaissance."
}