# CVE-2026-10586: WPDeveloper Essential Blocks SSRF in save_ai_generated_image

Source: https://junglewise.ai/threats/cve-2026-10586-wpdeveloper-essential-blocks-ssrf-in-save-ai-generated-image  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-05. Updated: 2026-06-05  
License: CC BY 4.0 with a link back

CVE-2026-10586 · Severity: high · CVSS 7.2 · Published 2026-06-05

A popular WordPress plugin used for building website pages is vulnerable to a security flaw that allows certain users to make unauthorized web requests. An attacker with Author-level permissions or higher can use the website's server to probe internal networks or access sensitive data from other services that are not normally exposed to the internet. This could lead to the exposure of internal configuration data or unauthorized interaction with private infrastructure.

Vendors: [WPDeveloper](https://junglewise.ai/threats/vendors/wpdeveloper).

## Quick answers

**Is CVE-2026-10586 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10586 being exploited in the wild.

**How severe is CVE-2026-10586?** High severity, with a CVSS score of 7.2, published 5 June 2026.

**Which products and versions are affected?** WPDeveloper Essential Blocks Up to and including 6.1.3.

**Is there a fix for CVE-2026-10586?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10586 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10586?** Check whether you run WPDeveloper Essential Blocks at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a Server-Side Request Forgery (SSRF) located in the `save_ai_generated_image()` function within the `includes/Integrations/AI/AI.php` file of the Essential Blocks plugin. The flaw stems from insufficient validation of user-supplied URLs before the server initiates a request. An authenticated attacker with Author-level privileges or higher can exploit this to force the web server to perform GET or POST requests to arbitrary external or internal IP addresses. This can be leveraged to bypass firewalls, scan internal networks, or interact with internal metadata services (like AWS/GCP metadata endpoints). The vulnerability affects all versions up to and including 6.1.3.

## Affected products

- WPDeveloper Essential Blocks – Page Builder for Gutenberg Blocks & Patterns Up to and including 6.1.3

## Timeline

- 2026-06-05: advisory: NVD publication date

## References

- [https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.1.3/includes/Integrations/AI/AI.php](https://plugins.trac.wordpress.org/browser/essential-blocks/tags/6.1.3/includes/Integrations/AI/AI.php)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/08906577-162c-4875-b16c-18d4912c2611?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/08906577-162c-4875-b16c-18d4912c2611?source=cve)