What is the CVSS score of CVE-2025-11369?

CVE-2025-11369 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2025-11369

MEDIUM

Missing Authorization (CWE-862)

2025-12-17 security@wordfence.com

WordPress Authentication Bypass

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Apr 08, 2026 - 18:38 vuln.today

CVE Published

Dec 17, 2025 - 02:16 nvd

MEDIUM 4.3

DescriptionCVE.org

The Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.

AnalysisAI

Gutenberg Essential Blocks plugin for WordPress up to version 5.7.2 allows authenticated authors and above to access sensitive API keys for Instagram, Google Maps, and other external services due to missing capability checks on several callback functions. The vulnerability requires WordPress Author-level or higher privileges and carries a low real-world risk given the constrained attack surface and low EPSS score of 0.04%, though it does expose plaintext credentials to a wider internal threat model than intended.

Technical ContextAI

The vulnerability stems from insufficient authorization validation in WordPress REST API callback functions (get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo) within the Gutenberg Essential Blocks plugin. These functions fail to implement proper capability checks (CWE-862: Missing Authorization) before returning or processing sensitive configuration data. WordPress authors have the ability to edit posts and pages but should not have access to site-level API configuration. The plugin stores API keys in the WordPress options table, and these callbacks expose them without verifying whether the authenticated user has the manage_options capability required for such administrative data access. The flaw affects versions through 5.7.2 and is evidenced in the code repositories referenced for GoogleMap.php (line 50), Instagram.php (line 20), and OpenVerse.php (line 108).

Affected ProductsAI

Gutenberg Essential Blocks for WordPress, plugin versions up to and including 5.7.2. The plugin is identified by the WordPress plugin slug 'essential-blocks' and can be located via the official WordPress plugin repository. Code references confirm vulnerability in versions 5.7.0 and earlier; the advisory indicates the fix was applied after 5.7.2. Affected installations are any WordPress site running the plugin at version 5.7.2 or earlier with multiple user accounts at Author level or above.

RemediationAI

Update the Gutenberg Essential Blocks plugin to version 5.7.3 or later, which should restore proper capability checks (manage_options) to the vulnerable callback functions. Administrators can access the plugin update interface at Plugins > Installed Plugins or via wp-admin. Immediately after patching, audit any sensitive API keys exposed through the plugin (Instagram, Google Maps) and consider rotating them if the site has had Author-level or higher users with potentially hostile intent. As a temporary workaround pending patching, limit Author role access on shared or untrusted hosting, or restrict WordPress user account creation to trusted personnel only. Detailed remediation and vulnerability context are available from the Wordfence threat intelligence resource at https://www.wordfence.com/threat-intel/vulnerabilities/id/7e5b1e90-53f7-4afc-9544-c36afe1ee813 and the CleanTalk research summary at https://research.cleantalk.org/cve-2025-11369/.