## Summary
CVE-2026-66704 is an unauthenticated SSRF vulnerability in the WordPress plugin gutenverse-companion affecting versions <= 2.5.1. It allows an attacker to make the server issue requests to an attacker-controlled or arbitrary domain, potentially exposing internal services.
## Technical Details
- Vulnerability type: Server Side Request Forgery (SSRF) (CWE-918).
- Access: Unauthenticated (PR:N, UI:N).
- What the attacker can do: cause the WordPress server to execute outbound requests to an arbitrary domain.
- Potential outcomes described:
- Discovery of sensitive information from other services reachable from the server.
- Exploitation context: Patchstack notes this is expected to be used in mass-exploit campaigns.
## Affected
- WordPress plugin: gutenverse-companion
- Affected versions: <= 2.5.1
- Fixed version: update to 2.5.2 or later.
## Impact
- SSRF can enable attackers to reach internal network resources indirectly via the vulnerable server.
- The NVD/description indicates possible sensitive information exposure from other services running on the system.
## Mitigation
1. Update the gutenverse-companion plugin to 2.5.2 or later.
2. If you cannot update immediately, apply the temporary mitigation described by Patchstack (a mitigation rule to block attacks until patched).
3. If available in your environment, enable Patchstack auto-update for vulnerable plugins only.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CWE-918