CVE-2026-6663

MediumCVSS 4.8/10Last modified Jun 17, 2026

Description

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.

Metrics

CVSS 3.1 4.8/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: May 12, 2026
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-666307.6Administrator SQL Injection in PublishPress Series <= 3.1.3 versions.CVE-2026-666317.6Administrator SQL Injection in MC Woocommerce Wishlist <= 1.9.21 versions.CVE-2026-666326.5Unauthenticated Content Injection in Simple Cloudflare Turnstile <= 1.42.1 versions.CVE-2026-666337.1Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.CVE-2026-666344.3Subscriber Insecure Direct Object References (IDOR) in Modal Survey <= 2.0.2.2.3 versions.CVE-2026-666357.4Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slid CVE-2026-666366.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Marcin Wise Chat wise-chat allows Stor CVE-2026-666376.5Contributor Cross Site Scripting (XSS) in Featured Video Plus <= 2.3.3 versions.CVE-2026-666386.5Contributor Cross Site Scripting (XSS) in Frontend Admin by DynamiApps <= 3.29.10 versions.CVE-2026-666396.5Contributor Cross Site Scripting (XSS) in WPZOOM Forms – Contact Form Plugin for Gutenberg <= 2.0.4 versions.CVE-2026-66647.5An integer overflow in network packet parsing code in PgBouncer before 1.25.2 bypasses a boundary check and can lead to a crash. An unauthen CVE-2026-666406.5Contributor Cross Site Scripting (XSS) in Login With Ajax <= 4.5.1 versions.