CVE-2025-11361 is a Server-Side Request Forgery vulnerability (CWE-918) affecting the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin. The flaw exists in the eb_save_ai_generated_image function and allows authenticated users with Author or higher privileges to induce the server to make HTTP requests to arbitrary locations. This can lead to unauthorized querying and modification of internal services accessible from the server. The vulnerability affects all plugin versions up to 5.7.1. The CVSS 3.1 score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges at the Author level, no user interaction, and partial impact on confidentiality and integrity.

An attacker with Author-level or higher access can exploit this SSRF vulnerability to make the server perform arbitrary HTTP requests. This may allow the attacker to access or modify internal services that are not otherwise accessible externally, potentially leading to information disclosure and unauthorized data manipulation within the internal network environment. There is no indication of impact on availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, it is recommended to monitor the vendor's communications for updates. Until a fix is available, restrict Author-level access to trusted users only and consider disabling or removing the affected plugin if possible to mitigate risk.