CVE-2026-66704

Executive Summary

CVE-2026-66704 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability affecting the Gutenverse Companion WordPress plugin, specifically versions 2.5.1 and earlier. The vulnerability allows a remote, unauthenticated attacker to make the vulnerable server issue arbitrary HTTP requests to internal or external resources, potentially bypassing network segmentation and accessing sensitive internal services. With a CVSS score of 7.2 and a network-exploitable attack vector requiring no privileges or user interaction, this flaw represents a significant risk to any WordPress deployment running the affected plugin version, particularly those with internal network resources exposed to the web server. Currently, no patch is available from the vendor, and no public exploit code or proof-of-concept has been identified.

Technical Analysis

Server-Side Request Forgery (SSRF) is a vulnerability class in which an attacker can induce the server-side application to make HTTP requests to arbitrary destinations under the attacker's control. In the context of CVE-2026-66704, the Gutenverse Companion plugin fails to properly validate or sanitize user-supplied input that is subsequently used to construct a URL that the server fetches. This is classified under CWE-918 (Server-Side Request Forgery).

The fundamental mechanism of this flaw is that an unauthenticated remote attacker can submit a crafted URL parameter through a public-facing endpoint of the plugin. The plugin then processes this URL and issues an HTTP request from the server to the attacker-specified target. The attack surface includes any WordPress site with the Gutenverse Companion plugin version 2.5.1 or earlier installed and active. Because the default WordPress installation exposes plugin functionality through publicly accessible endpoints, no authentication is required to trigger the vulnerable behavior.

The critical distinction between a benign URL fetch function and a vulnerable SSRF is the lack of restrictions on the destination address. A secure implementation would filter requests to block access to internal IP ranges (e.g., 127.0.0.1, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), link-local addresses (169.254.169.254 — commonly used by cloud providers for metadata services), and non-standard ports. The description of CVE-2026-66704 indicates that these controls are absent or insufficient, allowing the server to reach internal resources.

The vulnerability is rated with a CVSS 3.1 base score of 7.2, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. This vector indicates: network attack vector (AV:N), low attack complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and a scope change (S:C) — the compromised component impacts resources beyond its security scope. The confidentiality impact is Low (C:L), and the integrity impact is Low (I:L), meaning the attacker can read or modify data from internal resources but not entirely compromise the system. The scope change is notable because it means the vulnerable plugin runs in one security context but can affect resources in a separate security context, which typically indicates access to the underlying infrastructure.

Since no technical details such as specific function names, endpoint paths, or parameter identifiers have been disclosed in the NVD description or CNA title, the exact code-level implementation cannot be described. However, based on the vulnerability class and the plugin's role as a WordPress companion tool, the flaw likely resides in a feature that fetches remote data for display, import, or integration purposes — common functionality in page builder and companion plugins.

Exploitation Scenarios

Disclaimer: No public proof-of-concept or exploit code has been identified for CVE-2026-66704. The following attack chain is inferred from the vulnerability class and standard SSRF exploitation techniques.

Step 1 — Reconnaissance/Target Identification: An attacker first identifies WordPress sites running the Gutenverse Companion plugin version 2.5.1 or earlier. This can be accomplished through web crawling, Google dorking (e.g., searching for "wp-content/plugins/gutenverse-companion"), or by probing WordPress sites for plugin version information exposed in page source code or HTTP headers. The attacker may also use Shodan or similar search engines to find exposed WordPress installations with the plugin's distinctive asset paths.

Step 2 — Triggering the SSRF Flaw: The attacker sends an HTTP request to a public-facing endpoint of the plugin that accepts a URL-like parameter. Because the vulnerability is unauthenticated (PR:N), no credentials or session tokens are required. The attacker crafts a request that embeds an internal IP address or cloud metadata endpoint as the destination URL. For example, the attacker might supply a URL pointing to http://169.254.169.254/latest/meta-data/ (the AWS EC2 metadata service) or http://127.0.0.1:8080/ (local services on the web server).

Step 3 — Payload Execution: The server receives the request, extracts the attacker-controlled URL, and issues an HTTP request to that destination on behalf of the attacker. The response is typically returned to the attacker, either directly in the HTTP response body or indirectly through other observable effects (e.g., timing differences, error messages, or stored data). For cloud-hosted WordPress installations, targeting the metadata service endpoint allows the attacker to retrieve IAM (Identity and Access Management) credentials, instance identity documents, security group information, and other sensitive cloud configuration data.

Step 4 — Post-Exploitation Impact: With internal access, the attacker can: (a) scan internal networks to identify live hosts and open ports; (b) access internal web applications that should not be publicly reachable; (c) retrieve cloud metadata tokens and credentials, potentially enabling lateral movement into cloud infrastructure; (d) make requests to databases or other services via the web server's localhost interface, potentially bypassing firewall rules; and (e) use the SSRF primitive to chain attacks against other internal services. The integrity impact (I:L) suggests the attacker may also be able to modify data on reachable internal services — for instance, by sending HTTP requests that alter configuration or deliver payloads to internal APIs.

Impact Assessment

The business impact of CVE-2026-66704 is primarily driven by the SSRF's ability to pivot from the web application layer into internal networks and cloud infrastructure. The unauthenticated nature of the vulnerability substantially increases its risk posture, as any internet-reachable WordPress site running the affected plugin version is exposed without requiring prior compromise or credential theft.

The CVSS vector highlights several critical aspects of the impact. The attack vector is Network (AV:N), meaning the vulnerability is exploitable remotely over the internet. The attack complexity is Low (AC:L), indicating that no special conditions or race conditions need to be won. Crucially, the scope is Changed (S:C), meaning the vulnerable plugin operates in one security context but the attacker can affect a different security context — this typically elevates the severity because it implies compromise of the underlying infrastructure or adjacent systems, not just the web application.

The confidentiality impact is Low, meaning limited disclosure of information — but in an SSRF context, this could include access to cloud metadata, internal service credentials, or sensitive internal web application data. The integrity impact is Low, allowing some modification of data, potentially including sending crafted requests to internal admin panels or APIs. Availability is unaffected (A:N).

For affected organizations, the primary blast radius includes: (1) internal network reconnaissance and data exfiltration; (2) cloud metadata credential theft leading to potential cloud account compromise; (3) lateral movement into internal systems reachable from the web server; (4) potential compliance violations if internal data is exposed; and (5) reputational damage from a security incident facilitated by an unpatched third-party WordPress plugin. The EPSS score has not yet been assigned by FIRST.org, and there is no known record of CVE-2026-66704 in CISA's Known Exploited Vulnerabilities catalog (KEV), nor any public exploit code at the time of writing.

Detection Guidance

Sigma Rule

title: Detect SSRF Attempt Against Gutenverse Companion Plugin
id: 2c7e5402-9b1a-4fd8-8d0e-9f62a40e7c07
status: experimental
description: Detects HTTP requests to WordPress sites with Gutenverse Companion plugin that contain internal IP addresses or cloud metadata endpoints in URL parameters, indicating potential SSRF exploitation attempts.
author: Valtersit Threat Intelligence Team
date: 2026/02/15
logsource:
  category: webserver
  product: apache
  definition: Detection relies on web server access logs capturing full request URIs and query strings.
detection:
  selection_cloud_metadata:
    http.url|contains:
      - '169.254.169.254'
      - 'metadata.google.internal'
      - 'metadata.azure.internal'
  selection_private_ips:
    http.url|contains:
      - '127.0.0.1'
      - '10.0.'
      - '10.1.'
      - '172.16.'
      - '172.17.'
      - '172.18.'
      - '172.19.'
      - '172.20.'
      - '172.21.'
      - '172.22.'
      - '172.23.'
      - '172.24.'
      - '172.25.'
      - '172.26.'
      - '172.27.'
      - '172.28.'
      - '172.29.'
      - '172.30.'
      - '172.31.'
      - '192.168.'
  selection_gutenverse:
    http.url|contains: 'gutenverse-companion'
  condition: selection_gutenverse and (selection_cloud_metadata or selection_private_ips)
  timeframe: 5m
falsepositives:
  - Legitimate internal resource references if the plugin has a legitimate feature to fetch internal URLs (unlikely but possible)
  - Administrative functions that intentionally fetch internal URLs
level: high

YARA Rule

rule Gutenverse_Companion_SSRF_Exploitation
{
    meta:
        author = "Valtersit Threat Intelligence Team"
        description = "Detects HTTP request payloads targeting Gutenverse Companion SSRF vulnerability CVE-2026-66704"
        date = "2026-02-15"
        cve = "CVE-2026-66704"
        severity = "high"
    strings:
        $plugin_path = "gutenverse-companion" ascii nocase
        $metadata_aws = "169.254.169.254" ascii nocase
        $metadata_gcp = "metadata.google.internal" ascii nocase
        $metadata_azure = "169.254.169.254/metadata" ascii nocase
        $localhost = "127.0.0.1" ascii
        $private_10 = "10.0." ascii
        $private_172 = "172.16." ascii
        $private_192 = "192.168." ascii
        $url_param = "url=" ascii nocase
        $http_like = "http://" ascii nocase
        $https_like = "https://" ascii nocase
    condition:
        uint16(0) == 0x0d0a or uint16(0) == 0x0a0d or filesize < 100KB and
        $plugin_path and ($metadata_aws or $metadata_gcp or $metadata_azure or $localhost or $private_10 or $private_172 or $private_192) and ($url_param and ($http_like or $https_like))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Gutenverse Companion SSRF Attempt (CVE-2026-66704)"; flow:established,to_server; content:"gutenverse-companion"; http_uri; content:"url="; http_uri; content:"169.254.169.254"; http_uri; sid:2034501; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

alert http any any -> any any (msg:"ET EXPLOIT Gutenverse Companion SSRF Attempt - Private IP (CVE-2026-66704)"; flow:established,to_server; content:"gutenverse-companion"; http_uri; pcre:"/url=[^&]*(127\.0\.0\.1|10\.(0|1)\.|172\.(16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)\.|192\.168\.)/i"; http_uri; sid:2034502; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

alert http any any -> any any (msg:"ET EXPLOIT Gutenverse Companion SSRF Attempt - Cloud Metadata (CVE-2026-66704)"; flow:established,to_server; content:"gutenverse-companion"; http_uri; content:"url="; http_uri; content:"metadata.google.internal"; http_uri; sid:2034503; rev:1; metadata:created_at 2026_02_15, updated_at 2026_02_15;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where event.category == "web" and
    url.path contains "gutenverse-companion" and
    (url.query contains "169.254.169.254" or
     url.query contains "metadata.google.internal" or
     url.query contains "127.0.0.1" or
     url.query matches ".*(10|172|192)\\.(0|1|16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31|168)\\.\\d+\\.\\d+.*") ]
  [ network where event.category == "web" and
    url.query contains "url=" and
    (url.query contains "http://" or url.query contains "https://") ]

Splunk SPL Query

index=web earliest=-15m
| WHERE url LIKE "%gutenverse-companion%"
| rex field=url "url=(?<ssrf_url>[^&]+)"
| WHERE match(ssrf_url, "169\\.254\\.169\\.254|metadata\\.google\\.internal|127\\.0\\.0\\.1|10\\.(0|1)\\.|172\\.(16|17|18|19|20|21|22|23|24|25|26|27|28|29|30|31)\\.|192\\.168\\.")
| stats count by src_ip, url, ssrf_url, _time
| sort - _time
| rename src_ip as "Source IP", url as "Request URL", ssrf_url as "Potential SSRF Target", _time as "Timestamp"

Wazuh OSSEC Rule

<group name="gutenverse-companion-ssrf,">
  <rule id="100501" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*gutenverse-companion\.*</field>
    <field name="url" type="pcre2">url=(http|https)://(169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|10\.0\.|10\.1\.)</field>
    <description>Gutenverse Companion plugin SSRF attempt detected - possible exploitation of CVE-2026-66704</description>
    <group>ssrf,exploit,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>

  <rule id="100502" level="12">
    <decoded_as>json</decoded_as>
    <field name="url">\.*gutenverse-companion\.*</field>
    <field name="url" type="pcre2">url=(http|https)://(192\.168\.|172\.(1[6-9]|2[0-9]|3[0-1])\.)</field>
    <description>Gutenverse Companion plugin SSRF attempt targeting private IP range - possible exploitation of CVE-2026-66704</description>
    <group>ssrf,exploit,wordpress,</group>
    <mitre>
      <id>T1190</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Status: The vendor has not released a patch for CVE-2026-66704 at the time of writing. Patch confidence is rated 0/4 — no patch evidence from any tracked source. No vendor fix, workaround, or affected version list beyond "<= 2.5.1" has been published.

Immediate Mitigations (while awaiting a vendor patch):

1. Disable the Gutenverse Companion plugin immediately if it is not essential for business operations. This is the strongest immediate mitigation since it removes the vulnerable attack surface entirely.
2. Implement a Web Application Firewall (WAF) rule to block HTTP requests containing gutenverse-companion in the URL path combined with parameters containing internal IP patterns (127.0.0.1, 10.x.x.x, 172.16.x.x-172.31.x.x, 192.168.x.x) or cloud metadata endpoints (169.254.169.254, metadata.google.internal).
3. Restrict outbound network access from the WordPress server using host-based or network firewalls. Block outbound connections to RFC-1918 private IP ranges and to the link-local metadata IP (169.254.169.254) from the web application process. This limits the SSRF blast radius even if the vulnerability is exploited.
4. Monitor web server access logs for anomalous requests containing URL parameters with IP addresses, especially after applying the detection rules above.
5. Apply virtual patching using your web application security solution, if one is available in your environment, to surgically block known SSRF patterns without removing the plugin.

Patch/Upgrade Steps:

1. Monitor the Gutenverse official WordPress.org plugin page and the vendor's release notes for a patch release.
2. When a patched version (i.e., > 2.5.1) is released, apply the update in a staging environment first and verify plugin compatibility with your theme and other plugins.
3. Upon successful testing, deploy the updated plugin to production systems as soon as possible.
4. Subscribe to the WordPress security mailing list to be notified of updates.

Long-Term Hardening:

1. Establish a policy to promptly update WordPress plugins, themes, and core as soon as updates are released. Enable automatic updates for plugins when feasible.
2. Consider replacing the Gutenverse Companion plugin with an actively maintained alternative if the vendor's response to this vulnerability is inadequate or slow.
3. Implement network segmentationso that WordPress web servers cannot reach sensitive internal services that they do not explicitly need to communicate with.
4. Deploy robust egress filtering that blocks outbound traffic to private IP ranges and cloud metadata endpoints from all application servers.
5. Regularly review and minimize the number of third-party plugins in use; remove any plugins that are not actively maintained or that have a history of security vulnerabilities.
6. Incorporate CVE monitoring for all WordPress components into your standard vulnerability scanning and patch management program.

References

1. NVD Entry for CVE-2026-66704 — https://nvd.nist.gov/vuln/detail/CVE-2026-66704
2. FIRST.org CVSS Calculator v3.1 — https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
3. CWE-918: Server-Side Request Forgery — https://cwe.mitre.org/data/definitions/918.html
4. OWASP Server-Side Request Forgery Prevention Cheat Sheet — https://cheatsheetseries.owasp.org/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.html
5. WordPress Plugin Directory: Gutenverse Companion (for update monitoring) — https://wordpress.org/plugins/

At the time of writing, there are no known threat actor campaigns leveraging CVE-2026-66704, no exploit-in-the-wild evidence, and no public proof-of-concept or exploit code. The CVE is not listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Organizations should still treat this as a high-priority unauthenticated vulnerability given the widespread deployment of WordPress plugins and the critical nature of SSRF as an attack primitive.