CVE-2023-1895

CriticalCVSS 9.6/10Last modified Jun 17, 2026

Description

The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to Server Side Request Forgery via the get_remote_content REST API endpoint in versions up to, and including, 1.8.3. This can allow authenticated attackers with subscriber-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Metrics

CVSS 3.1 9.6/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Weakness enumeration

CWE-918

Affected software

Vendor	Product	Versions
jetmonsters	Getwid – Gutenberg Blocks	<= 1.8.3

References

Timeline

Published: Jun 9, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-18977.5Atlas Copco Power Focus 6000 web server does not sanitize the login information stored by the authenticated user’s browser, which could allo CVE-2023-18987.5Atlas Copco Power Focus 6000 web server uses a small amount of session ID numbers. An attacker could enter a session ID number to retrieve d CVE-2023-18997.5Atlas Copco Power Focus 6000 web server is not a secure connection by default, which could allow an attacker to gain sensitive information b CVE-2023-19005.5A vulnerability within the Avira network protection feature allowed an attacker with local execution rights to cause an overflow. This could CVE-2023-19018.0The bluetooth HCI host layer logic not clearing a global reference to a semaphore after synchronously sending HCI commands may allow a malic CVE-2023-19028.0The bluetooth HCI host layer logic not clearing a global reference to a state pointer after handling connection events may allow a malicious CVE-2023-19034.3SAP HCM Fiori App My Forms (Fiori 2.0) - version 605, does not perform necessary authorization checks for an authenticated user exposing the CVE-2023-19047.5In affected versions of Octopus Server it is possible for the OpenID client secret to be logged in clear text during the configuration of Oc CVE-2023-19055.4The WP Popups WordPress plugin before 2.1.5.1 does not properly escape the href attribute of its spu-facebook-page shortcode before outputti CVE-2023-19065.5A heap-based buffer overflow issue was discovered in ImageMagick's ImportMultiSpectralQuantum() function in MagickCore/quantum-import.c. An CVE-2023-19077.5A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another CVE-2023-19089.8A vulnerability was found in SourceCodester Simple Mobile Comparison Website 1.0. It has been classified as critical. Affected is an unknown