Unauthorized Data Access in Gutenberg Essential Blocks for WordPress
CVE-2025-11369

4.3MEDIUM

Key Information:

Vendor: WordPress
Status: Gutenberg Essential Blocks – Page Builder For Gutenberg Blocks & Patterns
Vendor: CVE Published:; 17 December 2025

What is CVE-2025-11369?

The Gutenberg Essential Blocks plugin for WordPress is susceptible to unauthorized access of sensitive data due to insufficient capability checks on certain function callbacks. Specifically, the get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo functions lack proper authentication measures. This vulnerability allows authenticated users with Author-level access or higher to potentially expose API keys linked to external services, creating risks for the data integrity and security of the WordPress site.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns * <= 5.7.2

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...

https://plugins.trac.wordpress.org/browser/essential-bloc...

CVSS V3.1

Score:

4.3

Severity:

MEDIUM

Confidentiality:

Low

Integrity:

None

Availability:

Low

Attack Vector:

Network

Attack Complexity:

Low

Privileges Required:

Low

User Interaction:

None

Scope:

Unchanged

Timeline

Vulnerability published
Dec 17, 2025
Vulnerability Reserved
Oct 6, 2025

Credit

Dmitrii Ignatyev

JSON

WordPress