CVE-2025-11361

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11361", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-06T09:25:38.394Z", "datePublished": "2025-10-18T04:25:56.613Z", "dateUpdated": "2026-04-08T17:25:51.712Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:51.712Z"}, "affected": [{"vendor": "wpdevteam", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.7.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "title": "Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Admin/Admin.php#L865"}, {"url": "https://research.cleantalk.org/cve-2025-11361/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-918 Server-Side Request Forgery (SSRF)", "cweId": "CWE-918", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "timeline": [{"time": "2025-10-01T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-10-06T09:40:55.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-10-17T16:25:07.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-20T16:29:52.340681Z", "id": "CVE-2025-11361", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T16:29:59.276Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11361", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-10-20T16:29:52.340681Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-20T16:29:55.533Z"}}], "cna": {"title": "Essential Blocks <= 5.7.1 - Authenticated (Author+) Server-Side Request Forgery", "credits": [{"lang": "en", "type": "finder", "value": "Dmitrii Ignatyev"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "wpdevteam", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.7.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-01T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-10-06T09:40:55.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-10-17T16:25:07.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Admin/Admin.php#L865"}, {"url": "https://research.cleantalk.org/cve-2025-11361/"}], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-918", "description": "CWE-918 Server-Side Request Forgery (SSRF)"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:25:51.712Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11361", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:25:51.712Z", "dateReserved": "2025-10-06T09:25:38.394Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-18T04:25:56.613Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns", "vendor": "wpdevteam", "versions": [{"lessThanOrEqual": "5.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.7.1 via the eb_save_ai_generated_image function. This makes it possible for authenticated attackers, with Author-level access and above, to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services."}, {"lang": "es", "value": "El plugin Gutenberg Essential Blocks - Page Builder for Gutenberg Blocks & Patterns para WordPress es vulnerable a la falsificaci\u00f3n de petici\u00f3n del lado del servidor en todas las versiones hasta la 5.7.1, inclusive, a trav\u00e9s de la funci\u00f3n eb_save_ai_generated_image. Esto hace posible que atacantes autenticados, con acceso de nivel Autor o superior, realicen peticiones web a ubicaciones arbitrarias originadas desde la aplicaci\u00f3n web y puede utilizarse para consultar y modificar informaci\u00f3n de servicios internos."}], "id": "CVE-2025-11361", "lastModified": "2026-10-09T10:10:00.193", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11361", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-10-20T16:29:52.340681Z", "version": "2.0.3"}}]}, "published": "2025-10-18T05:15:33.607", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Admin/Admin.php#L865"}, {"source": "security@wordfence.com", "url": "https://research.cleantalk.org/cve-2025-11361/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d4b06b93-6b15-4b1f-bdd9-080618591bdc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-918"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T02:14:32.100606+00:00", "value": {"mitigation_remediation": ["Update Gutenberg Essential Blocks to version 5.7.2 or later, which removes the unsafe URL handling in eb_save_ai_generated_image.", "Restrict Author\u2011level permissions for users who do not require access to the image generation feature, limiting the attack surface.", "Implement network request filtering at the application level (or firewall) to block outbound connections from the WordPress process to internal or sensitive resources, mitigating SSRF exploitation."], "summary": {"action": "Patch Now", "impact": "Server\u2011Side Request Forgery (SSRF)."}, "threat_synthesis": {"affected_systems": "WordPress plugin Gutenberg Essential Blocks \u2013 Page Builder for Gutenberg Blocks & Patterns, versions up to and including 5.7.1 are affected. The vulnerability exists in all releases from the earliest version through 5.7.1.", "description_and_impact": "The Gutenberg Essential Blocks plugin uses the eb_save_ai_generated_image function to generate images. This function accepts a URL parameter and forwards the request to a remote host without validating the target. An authenticated user with Author role or higher can invoke this function, permitting the server to send HTTP requests to arbitrary addresses. This behavior can be leveraged to exfiltrate internal data or modify resource state, matching CWE\u2011918.", "risk_and_exploitability": "The CVSS score is 6.4, indicating a moderate severity. The EPSS score is below 1%, suggesting a low probability of exploitation at this time, and the issue is not listed in the CISA KEV catalog. Attackers need only authenticated Author\u2011level access, which is typically granted to content contributors. Once the function is called, the plugin can direct the server to any network location, including internal services, making the exploit practical for internal reconnaissance or denial\u2011of\u2011service attacks."}}}}, "created": "2025-10-20T13:21:44.932090+00:00", "updated": "2026-04-21T02:15:06.533791+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wpdevteam", "wpdevteam$PRODUCT$gutenberg_essential_blocks"]}