CVE-2026-6663

Name of the Vulnerable Software and Affected Versions GWD Connect plugin for WordPress versions prior to 2.10

Description Missing authorization in the plugin allows limited code execution on unregistered installations in certain environments. The issue occurs because the standalone agent endpoints 'gwd-backup.php' and 'gwd-logs.php' do not verify authentication when the API key is not configured, which is the default state. Unauthenticated attackers can execute arbitrary code on the server via the update agent action, which writes attacker-supplied PHP code to the agent file.

Recommendations Update the GWD Connect plugin for WordPress to version 2.10 or later.