Executive brief
A popular WordPress plugin used for building website pages is vulnerable to a security flaw that allows certain users to make unauthorized web requests. An attacker with Author-level permissions or higher can use the website's server to probe internal networks or access sensitive data from other services that are not normally exposed to the internet. This could lead to the exposure of internal configuration data or unauthorized interaction with private infrastructure.
Technical details
The vulnerability is a Server-Side Request Forgery (SSRF) located in the `save_ai_generated_image()` function within the `includes/Integrations/AI/AI.php` file of the Essential Blocks plugin. The flaw stems from insufficient validation of user-supplied URLs before the server initiates a request. An authenticated attacker with Author-level privileges or higher can exploit this to force the web server to perform GET or POST requests to arbitrary external or internal IP addresses. This can be leveraged to bypass firewalls, scan internal networks, or interact with internal metadata services (like AWS/GCP metadata endpoints). The vulnerability affects all versions up to and including 6.1.3.
Affected products
- WPDeveloper Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Up to and including 6.1.3
Timeline
- 2026-06-05: advisory: NVD publication date