The Gutenverse WordPress plugin contains an SSRF vulnerability (CWE-918) in its import_images() function, which can be exploited by authenticated users with contributor-level privileges or above. This flaw enables these users to cause the server to make arbitrary HTTP requests to internal or external resources, potentially exposing or modifying sensitive internal information. The vulnerability affects all versions up to 3.5.3. The CVSS 3.1 base score is 6.4, reflecting a medium severity with network attack vector, low attack complexity, and privileges required. No official fix or patch has been published by the vendor as of the current data.

An attacker with contributor-level or higher access can exploit this SSRF vulnerability to make the server send arbitrary HTTP requests. This can lead to unauthorized querying or modification of internal services and data accessible from the server environment. The impact includes limited confidentiality and integrity loss but no direct availability impact. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict contributor-level access to trusted users only and monitor for suspicious activity related to the plugin's import functionality. Avoid exposing sensitive internal services that could be targeted via SSRF.