CVE-2026-6663

GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent

Published May 12, 2026 CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Description

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.

Analysis

Technical impact

The GWD Connect plugin for WordPress includes two PHP scripts (gwd-backup.php and gwd-logs.php) that expose an update_agent endpoint. The plugin fails to verify authentication when no API key has been configured – the default state for unregistered installations – allowing attackers to send specially crafted requests that write arbitrary PHP code to the agent file, enabling limited code execution on the server.

Affected Systems

WordPress sites running the GWD Connect plugin from GWD Conex, all release versions up to and including 2.9, with the default configuration of no API key and no external authentication.

Risk and Exploitability

The vulnerability carries a CVSS score of 4.8, indicating moderate impact. EPSS data is not available, and the flaw is not listed in CISA’s KEV catalog. Attackers can exploit it by issuing an unauthenticated HTTP request to the update_agent endpoint on an unregistered site that has not configured an API key. The exploitation grants the ability to inject PHP code, but is limited to the plugin’s agent file and therefore may not provide full system compromise without additional vulnerabilities or misconfigurations.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

thewebsitesupply

GWD Conex

unaffected

Version	Status	Constraints
`0`	affected	≤ 2.9

No data.

Vendor Product Versions

Thewebsitesupply

Gwd Conex

Version	Status	Scheme	Platform
`[0,2.9]`	affected	generic	—

Wordpress

Version	Status	Scheme	Platform
`—`	unaffected	—	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the GWD Connect plugin to the latest available version that protects the update_agent endpoint from unauthenticated requests.
If an upgrade is not possible, immediately configure an API key in the plugin’s settings; once a key is set the endpoints will enforce authentication and refuse unauthenticated update_agent actions.
Limit exposure of the gwd-backup.php and gwd-logs.php scripts by restricting access in the web server configuration (e.g., using .htaccess rules or firewall rules) so that only trusted IP addresses or authenticated users can reach them.

Generated by OpenCVE AI on May 12, 2026 at 10:42 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.273% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-backup.php?marks=1991,2002,2548#L1991
https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-logs.php?marks=398,403,851#L398
https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2d435f-d6ce-41bd-8a45-e252fb4ba419?source=cve

History

May 13, 2026 11:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Thewebsitesupply Thewebsitesupply gwd Conex Wordpress Wordpress wordpress
Vendors & Products		Thewebsitesupply Thewebsitesupply gwd Conex Wordpress Wordpress wordpress

May 12, 2026 1:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

May 12, 2026 8:30 AM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.
Title		GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
Weaknesses		CWE-862
References		https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-backup.php?marks=1991,2002,2548#L1991 https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-logs.php?marks=398,403,851#L398 https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2d435f-d6ce-41bd-8a45-e252fb4ba419?source=cve
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}`