Critical severity · published Jun 9, 2023
CVE-2023-1895
Getwid – Gutenberg Blocks <= 1.8.3 - Authenticated(Subscriber+) Server Side Request Forgery
9.6
CVSS
0.6%
EPSS
No
On KEV
Description
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 49% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
GG
Getwid – Gutenberg Blocks · jetmonsters
through 1.8.3 · source: vendor
GE
Getwid · Motopress
through 1.8.3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-1895
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-1895
Issue Tracking
https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.php
www.wordfence.com
https://www.wordfence.com/blog/2023/06/credential-stealing-server-side-request-forgery-patched-in-getwid/
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cve
More from Getwid – Gutenberg Blocks
6.4
CVE-2026-91862
Getwid <= 3.0.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'data-image-points'
6.4
CVE-2026-5924
Getwid <= 2.1.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Google Maps 'customStyle'
6.4
CVE-2024-5020
Multiple Plugins <= (Various Versions) - Authenticated (Contributor+) Stored DOM-Based Cross-Site Scripting via FancyBox JavaScript Library
5.4
CVE-2024-10872
Getwid – Gutenberg Blocks <= 2.0.12 - Authenticated (Contributor+) Stored Cross-Site Scripting
5.4
CVE-2024-3588
Getwid – Gutenberg Blocks <= 2.0.7 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'Countdown'