GWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent
mediumThe GWD Connect plugin for WordPress is vulnerable to missing authorization to limited code execution in all versions up to, and including, 2.9. This is due to the plugin's standalone agent endpoints (gwd-backup.php and gwd-logs.php) not verifying authentication when the API key has not been configured, which is the de...
- CVSS:
- 4.8
- Affected:
- up to 2.9
- Fix:
- No patched version reported
- Disclosed:
- May 11, 2026