Security readout for executives and security teams
Plain-English summary
This vulnerability lets a logged-in low-privilege WordPress user force the affected site to make requests to arbitrary locations. That can expose internal services or cloud metadata reachable from the web server. It matters most on sites with public registration, many subscribers, or sensitive internal services behind the WordPress host.
Executive priority
Treat this as high priority for WordPress environments with public accounts or sensitive internal networks. There is no confirmed active exploitation in the provided sources, but the low privilege requirement and SSRF impact justify prompt remediation.
Technical view
Getwid – Gutenberg Blocks versions up to and including 1.8.3 expose SSRF through the get_remote_content REST API endpoint. An authenticated Subscriber+ user can trigger server-originated requests to arbitrary targets, with possible confidentiality impact and limited integrity impact against reachable internal services.
Likely exposure
Exposure is likely limited to WordPress sites running Getwid – Gutenberg Blocks <= 1.8.3 where an attacker can authenticate as Subscriber or higher. Sites allowing public account creation, weak account hygiene, or many low-privilege users have higher practical exposure.
Exploitation context
The provided sources do not show CISA KEV listing or confirmed active exploitation. The issue is still serious because SSRF can turn a low-privilege WordPress account into a path for probing or interacting with services reachable only from the server.
Researcher notes
Focus validation on authenticated access, plugin version, REST endpoint exposure, and server-side network reachability. Avoid assuming compromise from version alone; confirm whether attackers could obtain Subscriber+ access and whether internal targets are reachable from the WordPress host.
Mitigation direction
- Upgrade Getwid – Gutenberg Blocks to a version newer than 1.8.3 per vendor guidance.
- Disable the plugin if immediate upgrade is not possible.
- Limit or disable public user registration where it is not required.
- Review and remove unnecessary Subscriber-or-higher accounts.
- Restrict server egress to internal services and metadata endpoints where feasible.
Validation and detection
- Inventory WordPress sites for Getwid – Gutenberg Blocks versions <= 1.8.3.
- Confirm whether low-privilege user registration or subscriber access is enabled.
- Review logs for get_remote_content REST API activity and unusual internal destinations.
- Assess internal services reachable from the WordPress server.
- Verify the plugin is upgraded or disabled on all affected sites.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-918: Information exposure and cloud metadata lookup
Information exposure and SSRF weaknesses can make discovery, cloud metadata, and credential material review relevant. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2023-1895 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.5 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N3.14.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.5HighVector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e9c2a942-c14c-4b59-92a7-6946b2e4731b?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/getwid/tags/1.8.3/includes/rest-api.phpCVE reference
- https://www.wordfence.com/blog/2023/06/credential-stealing-server-side-request-forgery-patched-in-getwid/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Server-Side Request Forgery (SSRF)
Server-Side Request Forgery (SSRF) represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.