CVE-2026-6663

The GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the default state. This makes it possible for unauthenticated attackers - on unregistered installations only, in certain environments - to execute arbitrary code on the server via the update_agent action, which writes attacker-supplied PHP code to the agent file.

• CWE-862

• https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-backup.php?marks=1991,2002,2548#L1991
• https://plugins.trac.wordpress.org/browser/graphic-web-design-inc/tags/2.9/gwd-logs.php?marks=398,403,851#L398
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4d2d435f-d6ce-41bd-8a45-e252fb4ba419?source=cve

Published

May 12, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-6654Double-Free / Use-After-Free (UAF) in the `IntoIter::drop` a…5.1
• CVE-2026-6656Crypt::Password versions through 0.28 for Perl are susceptib…7.5
• CVE-2026-6657A vulnerability in jupyter-server versions 1.12.0 through 2.…8.8
• CVE-2026-6658A vulnerability in jupyter/nbconvert versions <= 7.17.0 allo…5.4
• CVE-2026-6659Crypt::PasswdMD5 versions through 1.42 for Perl generates in…7.5
• CVE-2026-6662A vulnerability was found in ericc-ch copilot-api up to 0.7.…7.3
• CVE-2026-6664An integer overflow in network packet parsing code in PgBoun…7.5
• CVE-2026-66642Cross-Site Request Forgery (CSRF) vulnerability in WP Umbrel…5.4
• CVE-2026-6665The SCRAM code in PgBouncer before 1.25.2 did not check the …9.8
• CVE-2026-66659Improper Neutralization of Special Elements used in an SQL C…9.3
• CVE-2026-6666A possible null pointer reference in PgBouncer before 1.25.2…7.5
• CVE-2026-66662Unauthenticated Privilege Escalation in Frontend Admin by Dy…9.8