The Gutenverse plugin for WordPress contains a Server‑Side Request Forgery flaw in its import_images() function. An authenticated user with contributor-level access or higher can supply an arbitrary URL to the imageUrl field, causing the plugin to initiate a request from the web server to any chosen destination. This allows the attacker to read data from internal services, and in some cases to send write requests that may alter data or configurations on those services.

The vulnerability affects the Jegstudio Gutenverse – Ultimate WordPress FSE Blocks Addons & Ecosystem plugin in all releases up to and including version 3.5.3. Any WordPress site installing a vulnerable version of this plugin is at risk.

The CVSS score of 6.4 indicates a moderate severity. Because the attack requires only contributor or higher privileges within the WordPress installation, the likelihood of exploitation is non‑trivial for compromised or poorly secured user accounts. The flaw does not directly expose external services, yet it can be used to query or modify internal resources when the plugin’s server environment has network access to those resources. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the combination of authenticated access and the ability to target internal hosts makes remediation a priority.