CVE-2025-11361
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Lifecycle Timeline
2Description
The Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
Analysis
Server-Side Request Forgery in Gutenberg Essential Blocks plugin for WordPress allows authenticated attackers with Author-level or higher privileges to make arbitrary web requests originating from the vulnerable server via the eb_save_ai_generated_image function, enabling reconnaissance and manipulation of internal services. Affects all versions up to 5.7.1 with CVSS 6.4 severity; no active KEV status or public exploit code confirmed at time of analysis.
Technical Context
The vulnerability exists in the eb_save_ai_generated_image function within the Essential Blocks WordPress plugin, which fails to properly validate or sanitize user-supplied URLs before using them in server-side HTTP requests. This is a classic CWE-918 Server-Side Request Forgery (SSRF) flaw where attacker-controlled input is passed to functions that initiate network requests without adequate endpoint validation. The affected plugin integrates with Gutenberg's block editor infrastructure, making it accessible to any authenticated user with Author role or above. The SSRF allows attackers to bypass network segmentation by using the web application as a proxy to query internal services, metadata endpoints (such as AWS IMDSv1), or other restricted resources that would not be directly accessible from the attacker's network position.
Affected Products
Gutenberg Essential Blocks plugin for WordPress is vulnerable in all versions up to and including 5.7.1. The affected component is the plugin's admin functionality, specifically the eb_save_ai_generated_image function located in includes/Admin/Admin.php. Any WordPress installation running Essential Blocks version 5.7.1 or earlier with users holding Author role or above is potentially vulnerable. Verification can be performed by checking the plugin version in WordPress admin or via the plugin's SVN repository at https://plugins.trac.wordpress.org/browser/essential-blocks/.
Remediation
Update Gutenberg Essential Blocks to version 5.7.2 or later, which contains the security fix for the SSRF vulnerability in eb_save_ai_generated_image. Administrators should access WordPress admin panel, navigate to Plugins, and update Essential Blocks immediately. For users unable to update immediately, restrict Author-level and above access to trusted content creators only, and implement network-level controls to prevent internal service exposure (such as blocking outbound requests from the web server to internal IP ranges, or requiring explicit allowlisting of external URLs in the plugin configuration if such options exist). Additional information is available from Wordfence's vulnerability advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc and security research at https://research.cleantalk.org/cve-2025-11361/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today