Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery
CVE-2026-10586

7.2HIGH

Key Information:

Vendor

WordPress
Status
Gutenberg Essential Blocks – Page Builder For Gutenberg Blocks & Patterns
Vendor
CVE Published:
4 June 2026

What is CVE-2026-10586?

The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.1.3 via the save_ai_generated_image() function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services.

Affected Version(s)

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns 0 <= 6.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/essential-bloc...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shambles
.