CVE-2025-11369 is a missing authorization vulnerability (CWE-862) in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin. The issue arises from missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo functions in all versions up to and including 5.7.2. This flaw allows authenticated users with Author-level privileges or higher to view API keys configured for external services, potentially exposing sensitive information. The vulnerability has a CVSS v3.1 base score of 4.3, reflecting low complexity and limited impact confined to confidentiality.

An attacker with Author-level or higher access can view API keys for external services configured in the plugin. This exposure of sensitive credentials could lead to unauthorized use of those external services. There is no indication of impact on data integrity or availability. No known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor the vendor's communications for updates. Until a fix is available, restrict Author-level access to trusted users only to limit exposure.