CVE-2026-6663 is a missing authorization vulnerability (CWE-862) in the GWD Connect WordPress plugin. The plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) fail to verify authentication if the API key is not set, which is the default configuration. This allows unauthenticated attackers on unregistered installations to execute arbitrary code on the server by using the update_agent action to write attacker-supplied PHP code to the agent file. The vulnerability affects all versions up to and including 2.9. There is no vendor-provided patch or remediation level indicated at this time.

The vulnerability allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server, but only on unregistered installations where the API key is not configured. This can lead to limited code execution with potential confidentiality and integrity impacts. The CVSS score of 4.8 reflects a medium severity with network attack vector, high attack complexity, no privileges required, and no user interaction needed. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should ensure the API key is configured to prevent the plugin from operating in its default, vulnerable state. Disabling or removing the plugin on unregistered installations may also reduce risk.