CVE-2025-11369
MEDIUMCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Lifecycle Timeline
2Description
The Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.
Analysis
Gutenberg Essential Blocks plugin for WordPress up to version 5.7.2 allows authenticated authors and above to access sensitive API keys for Instagram, Google Maps, and other external services due to missing capability checks on several callback functions. The vulnerability requires WordPress Author-level or higher privileges and carries a low real-world risk given the constrained attack surface and low EPSS score of 0.04%, though it does expose plaintext credentials to a wider internal threat model than intended.
Technical Context
The vulnerability stems from insufficient authorization validation in WordPress REST API callback functions (get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo) within the Gutenberg Essential Blocks plugin. These functions fail to implement proper capability checks (CWE-862: Missing Authorization) before returning or processing sensitive configuration data. WordPress authors have the ability to edit posts and pages but should not have access to site-level API configuration. The plugin stores API keys in the WordPress options table, and these callbacks expose them without verifying whether the authenticated user has the manage_options capability required for such administrative data access. The flaw affects versions through 5.7.2 and is evidenced in the code repositories referenced for GoogleMap.php (line 50), Instagram.php (line 20), and OpenVerse.php (line 108).
Affected Products
Gutenberg Essential Blocks for WordPress, plugin versions up to and including 5.7.2. The plugin is identified by the WordPress plugin slug 'essential-blocks' and can be located via the official WordPress plugin repository. Code references confirm vulnerability in versions 5.7.0 and earlier; the advisory indicates the fix was applied after 5.7.2. Affected installations are any WordPress site running the plugin at version 5.7.2 or earlier with multiple user accounts at Author level or above.
Remediation
Update the Gutenberg Essential Blocks plugin to version 5.7.3 or later, which should restore proper capability checks (manage_options) to the vulnerable callback functions. Administrators can access the plugin update interface at Plugins > Installed Plugins or via wp-admin. Immediately after patching, audit any sensitive API keys exposed through the plugin (Instagram, Google Maps) and consider rotating them if the site has had Author-level or higher users with potentially hostile intent. As a temporary workaround pending patching, limit Author role access on shared or untrusted hosting, or restrict WordPress user account creation to trusted personnel only. Detailed remediation and vulnerability context are available from the Wordfence threat intelligence resource at https://www.wordfence.com/threat-intel/vulnerabilities/id/7e5b1e90-53f7-4afc-9544-c36afe1ee813 and the CleanTalk research summary at https://research.cleantalk.org/cve-2025-11369/.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today