EUVD-2026-34771
GHSA-5rm6-jpq7-cq95
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (wordfence) · only source for this CVE.
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the save_ai_generated_image() function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.
AnalysisAI
Server-Side Request Forgery in the Essential Blocks WordPress plugin (versions through 6.1.3) allows authenticated users with Author-level access or higher to coerce the WordPress server into making arbitrary outbound HTTP requests via the save_ai_generated_image() function. The flaw enables attackers to probe internal network services, read responses from internal endpoints, and potentially modify state on services that trust requests from the WordPress host. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Technical ContextAI
Essential Blocks is a popular Gutenberg block library plugin for WordPress that adds page-builder style blocks and AI-assisted features. The vulnerable code path is includes/Integrations/AI/AI.php at line 171, where save_ai_generated_image() accepts a user-supplied URL and fetches it server-side without sufficient destination validation. This is a textbook CWE-918 (Server-Side Request Forgery): the server acts as a confused deputy, making outbound requests on behalf of a partially trusted user toward attacker-chosen targets, which on cloud-hosted sites commonly includes loopback services, metadata endpoints such as 169.254.169.254, and internal LAN ranges.
RemediationAI
No vendor-released patch identified at time of analysis from the provided references; administrators should monitor the Essential Blocks changelog on WordPress.org and the Wordfence advisory (https://www.wordfence.com/threat-intel/vulnerabilities/id/08906577-162c-4875-b16c-18d4912c2611) for a fixed release above 6.1.3 and upgrade immediately when published. Until a patched version is available, compensating controls include temporarily deactivating the Essential Blocks plugin if AI image generation is not in use, restricting Author and higher role assignments to fully trusted users, and enforcing egress filtering from the WordPress host to block requests to RFC1918 ranges, 127.0.0.0/8, and cloud metadata endpoints such as 169.254.169.254 - note that egress filtering may break legitimate integrations that call internal APIs, and disabling the plugin will remove all Essential Blocks content from rendering. A web application firewall rule that blocks requests to the relevant admin-ajax/REST endpoint invoking save_ai_generated_image() with non-allowlisted URL parameters is a more surgical option.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today