CVE-2026-10586
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The Gutenberg Essential Blocks plugin for WordPress up to version 6.1.3 contains a Server-Side Request Forgery (SSRF) vulnerability in the `save_ai_generated_image()` function. Authenticated attackers with Author-level access or higher can make requests to arbitrary external and internal locations, potentially reading or modifying data from internal services.
Risk Assessment
An attacker can scan internal networks, access sensitive data, or modify internal service configurations, potentially compromising the entire WordPress infrastructure.
Recommendation
Update the Gutenberg Essential Blocks plugin to version 6.1.4 or later if available.
Other vulnerabilities in Gutenberg Essential Blocks
See all- CVE-2026-13154High
The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not verify that an attacker-supplied post type is publicly viewable before querying it in one of its public REST routes. This allows unauthenticated users to read published entries of custom post types that the site registered as non-public.
- CVE-2026-13153High
The Gutenberg Essential Blocks WordPress plugin before version 6.4.0 does not restrict access to one of its public REST routes and over-fetches a non-public WooCommerce per-product sales metric into the response. This allows unauthenticated users to read the lifetime number of units sold for any published product.
Original NVD description (English source)
The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the `save_ai_generated_image()` function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.