CVE-2025-11361 Overview
CVE-2025-11361 is a Server-Side Request Forgery (SSRF) vulnerability in the Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress. The flaw affects all versions up to and including 5.7.1 and resides in the eb_save_ai_generated_image function. Authenticated users with Author-level access or higher can abuse this function to force the WordPress server to issue HTTP requests to arbitrary destinations. Attackers can leverage this behavior to probe internal services, query cloud metadata endpoints, or interact with resources that would otherwise be inaccessible from the public internet. The weakness is tracked under CWE-918.
Critical Impact
Authenticated Author-level attackers can coerce the WordPress server into issuing arbitrary outbound requests, enabling reconnaissance and interaction with internal network services.
Affected Products
- Essential Blocks – Page Builder for Gutenberg Blocks & Patterns (WordPress plugin)
- All versions up to and including 5.7.1
- WordPress sites allowing Author-level or higher user registration
Discovery Timeline
- 2025-10-18 - CVE-2025-11361 published to NVD
- 2026-10-09 - Last updated in NVD database
Technical Details for CVE-2025-11361
Vulnerability Analysis
The Essential Blocks plugin exposes an administrative action handler named eb_save_ai_generated_image that is intended to download AI-generated images and store them in the WordPress media library. The handler accepts a user-supplied URL and performs an outbound HTTP request to retrieve the referenced resource. Because the plugin does not validate the destination host or scheme, an authenticated user can supply an arbitrary URL, including private IP ranges, loopback addresses, or cloud instance metadata endpoints such as 169.254.169.254. The response or side effects of these requests can be used to enumerate internal infrastructure.
The required privilege level is Author or above, which lowers the barrier on sites that permit open registration or multi-author publishing workflows. For technical references, see the Wordfence Vulnerability Report and the CleanTalk CVE-2025-11361 Analysis.
Root Cause
The root cause is missing URL validation inside eb_save_ai_generated_image. The function accepts user-controlled input and passes it to WordPress HTTP client routines without restricting the target host, scheme, or address family. Review the vulnerable logic in the WordPress Essential Blocks Code at line 865 of Admin.php.
Attack Vector
An authenticated attacker with Author privileges issues a request to the Essential Blocks AJAX endpoint, supplying a crafted URL parameter that references an internal service, cloud metadata API, or non-HTTP scheme supported by the underlying HTTP client. The WordPress server then performs the request on behalf of the attacker. Successful exploitation can disclose internal service responses, trigger state changes on unauthenticated internal APIs, and in cloud environments retrieve temporary credentials from instance metadata services.
No verified public exploit code is available for this vulnerability. Refer to the external references for additional technical detail.
Detection Methods for CVE-2025-11361
Indicators of Compromise
- Outbound HTTP requests from the WordPress server to internal IP ranges such as 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, or loopback addresses
- Requests from the WordPress host to cloud metadata endpoints like 169.254.169.254 originating from PHP processes
- Unexpected invocations of the eb_save_ai_generated_image AJAX action in webserver access logs
- Author-level user accounts created shortly before suspicious outbound traffic patterns
Detection Strategies
- Monitor WordPress wp-admin/admin-ajax.php logs for the eb_save_ai_generated_image action parameter paired with URL values targeting non-public destinations
- Correlate authenticated Author-session activity with outbound network flows from PHP-FPM or Apache worker processes
- Alert on any egress traffic from web servers to RFC1918 ranges, link-local addresses, or cloud metadata IPs
Monitoring Recommendations
- Enable WordPress audit logging to capture AJAX action invocations and the authenticated user identity
- Forward webserver and WordPress logs to a centralized SIEM for correlation with network telemetry
- Establish baselines for expected outbound traffic from WordPress hosts and alert on deviations
How to Mitigate CVE-2025-11361
Immediate Actions Required
- Update the Essential Blocks plugin to a version later than 5.7.1 as soon as a patched release is available
- Audit Author-level and higher accounts and remove any that are unnecessary or inactive
- Restrict open user registration or require administrator approval for new accounts with publishing privileges
- Review recent webserver logs for exploitation attempts targeting eb_save_ai_generated_image
Patch Information
The vulnerability affects Essential Blocks through version 5.7.1. Site administrators should install the vendor-released patched version through the WordPress plugin updater. Consult the Wordfence Vulnerability Report for the current fixed version and vendor advisory details.
Workarounds
- Temporarily deactivate the Essential Blocks plugin until a patched release is deployed
- Enforce network-level egress filtering on the WordPress server to block requests to RFC1918, loopback, and cloud metadata address ranges
- Place the WordPress host behind a web application firewall configured to inspect and block AJAX requests referencing internal URLs
- Require instance metadata service version 2 (IMDSv2) on AWS and equivalent protections on other cloud providers to reduce credential theft risk
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.