Security Alert Summary
The Gutenberg Essential Blocks 6 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress contains missing or incorrect capability checks in several callback functions. Authenticated users with Author-level access and above may be able to view API keys configured for external services.
CVE Details
- CVE ID: CVE-2025-11369
- Affected plugin / component: Gutenberg Essential Blocks 6 Page Builder for Gutenberg Blocks & Patterns plugin for WordPress
- Affected versions: All versions up to, and including, 5.7.2
- Published: December 17, 2025 at 02:16:00 AM UTC
- Last modified: December 17, 2025 at 02:16:00 AM UTC
- CVSS v3.1: Base Score 4.3 — MEDIUM; Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User interaction: Requires an authenticated user with low privileges (PR:L). The CVE description specifies authenticated attackers with Author-level access and above. User interaction: None.
- Primary impact: Confidentiality: Low; Integrity: None; Availability: None
- CWE / Weakness ID: CWE-862
Technical Details
According to the CVE entry, the plugin fails to perform correct capability checks in several functions, specifically get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo. Because those checks are missing or incorrect, authenticated users who have Author-level privileges (or higher) can access API keys and related configuration for external services.
The issue exists where permission validation is expected but not enforced before returning or saving sensitive configuration data. The CVE description identifies the named functions as the locations where capability checks are absent or incorrect, which enables exposure of API credentials to users who should not have access to them.
How This Could Impact Your Website
In a typical small- or medium-sized WordPress site, you may have a site owner, internal staff (editors or authors), and external contributors or contractors with Author-level access. If an Author-level account is abused or malicious, that user could access API keys configured for services like Instagram or Google Maps via the affected plugin functions. Exposed API keys can increase the risk of targeted misuse of those third-party services and enable social engineering, phishing, or information harvesting related to those integrations.
The impact described in the CVE is limited to disclosure of configuration data (confidentiality impact rated as Low) and does not indicate modification of site content or disruption of availability. If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles and capabilities, especially for contributors and authors.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins to reduce your attack surface.
- Monitor site activity and logs for unusual behavior related to settings or integration endpoints.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/GoogleMap.php#L50
- https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/Instagram.php#L20
- https://plugins.trac.wordpress.org/browser/essential-blocks/tags/5.7.0/includes/Integrations/OpenVerse.php#L108
- https://www.wordfence.com/threat-intel/vulnerabilities/id/7e5b1e90-53f7-4afc-9544-c36afe1ee813?source=cve
