CVE-2026-10586: Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns <= 6.1.3 - Authenticated (Author+) Server-Side Request Forgery

Synopsis

Server-Side Request Forgery (SSRF) affects the Gutenberg Essential Blocks plugin for WordPress, versions 6.1.3 and earlier, via the save_ai_generated_image() function. The vulnerability is reachable over the network and requires no authentication barrier beyond a standard Author-level WordPress account. Successful exploitation allows an attacker to send arbitrary web requests from the WordPress server to internal services, enabling both data retrieval and modification of internal resources. HarborGuard is tracking this advisory and will make a patched-image rebuild available the moment an upstream fix is published.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable function is exposed over the network, so an attacker must be able to reach the WordPress application via HTTP/HTTPS.

• AuthenticationRequired

  An attacker must hold at least an Author-level WordPress account; any low-privilege account at that role or above is sufficient.

• Victim interactionNot required

  No victim interaction is needed; the attacker can trigger the SSRF directly without involving another user.

• Attack complexityDetail

  Attack complexity is low, meaning the exploit is reliable and requires no special timing, race conditions, or environmental preconditions.

Blast Radius

• The attacker can cause the WordPress server to issue HTTP requests to internal network addresses, effectively using it as a proxy to probe otherwise unreachable services.
• Internal service responses can be read back by the attacker, exposing configuration data, credentials, or other sensitive information stored on internal endpoints.
• The attacker can send crafted requests that modify state on internal services, such as triggering actions via internal APIs or management endpoints that assume requests originate from a trusted host.
• In cloud-hosted environments, this commonly includes querying instance metadata endpoints (such as AWS IMDSv1) to retrieve cloud credentials scoped to the host.