{"id":"CVE-2025-11361","title":"The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function","summary":"The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This…","severity":"medium","cvss":6.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","cwe":["CWE-918"],"published":"2025-10-18","updated":"2026-10-09","sourceUpdated":"2026-10-09T10:10:00.193","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-11361","references":[{"url":"https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Admin/Admin.php#L865","label":"security@wordfence.com"},{"url":"https://research.cleantalk.org/cve-2025-11361/","label":"security@wordfence.com"},{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc?source=cve","label":"security@wordfence.com"}],"tags":["nvd"],"epss":0.00301,"epssPercentile":0.20966,"ingestedAt":"2026-10-09T12:53:29.119Z","slug":"CVE-2025-11361","body":"## Overview\n\nThe Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":35,"depthScoreParts":{"impact":35.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}