{
 "id": "WPSEC-2026-0555",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0555/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0555/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0555/index.md",
 "title": "GutenKit <= 2.5.2 - Authenticated (Author+) Server-Side Request Forgery via Media Upload From URL Route",
 "description": "The GutenKit plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 2.5.2 via the media upload from URL REST route, which fetched any URL supplied in the request instead of only the template library's own hosts. This makes it possible for authenticated attackers with Author-level access and above (users with the upload_files capability) to make the web server request arbitrary URLs, including on the site's own host, and save the responses as media library files they can then open, provided a response passes WordPress's upload file-type check. WordPress's safe HTTP API still blocks loopback and private-network addresses.",
 "plugin": {
  "slug": "gutenkit-blocks-addon",
  "name": "GutenKit",
  "full_name": "GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor",
  "wordpress_org": "https://wordpress.org/plugins/gutenkit-blocks-addon/",
  "advisories_url": "https://wpsec.com/vuln/plugin/gutenkit-blocks-addon/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/gutenkit-blocks-addon"
 },
 "type": "SSRF",
 "cwe": [
  "CWE-918"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.0,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "2.5.3",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 2.5.3"
  ]
 },
 "introduced_in": null,
 "fixed_in": "2.5.3",
 "remediation": "Update to 2.5.3 or later.",
 "fix_released": "2026-10-06T14:38:38+00:00",
 "published": "2026-10-07T14:47:02+00:00",
 "updated": "2026-10-06T16:46:15.514108+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0555/",
  "https://plugins.svn.wordpress.org/gutenkit-blocks-addon/tags/2.5.3/",
  "https://wordpress.org/plugins/gutenkit-blocks-addon/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/gutenkit-blocks-addon",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-07"
 }
}