Server-Side Request Forgery in WordPress Gutenberg Essential Blocks Plugin
CVE-2026-10586

7.2HIGH

Key Information:

Vendor

WordPress
Status
Gutenberg Essential Blocks – Page Builder For Gutenberg Blocks & Patterns
Vendor
CVE Published:
4 June 2026

What is CVE-2026-10586?

The Gutenberg Essential Blocks plugin for WordPress is susceptible to a Server-Side Request Forgery. This vulnerability affects all versions up to and including 6.1.3. It allows authenticated users with Author-level permissions or higher to execute web requests to arbitrary locations, originating from the web application itself. Such capability poses significant risks, as it may enable attackers to query and alter sensitive information from internal services, potentially leading to unauthorized data access and manipulation.

Affected Version(s)

Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns 0 <= 6.1.3

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/essential-bloc...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Shambles
.