CVE-2026-10586 is a Server-Side Request Forgery (SSRF) vulnerability in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin. The issue exists in the save_ai_generated_image() function and affects all plugin versions up to 6.1.3. Authenticated attackers with Author-level privileges or higher can leverage this vulnerability to make arbitrary HTTP requests originating from the web application server. This can be used to access or manipulate internal services that are otherwise inaccessible externally. The vulnerability is tracked under CWE-918 and has a CVSS 3.1 base score of 7.2, reflecting a high severity level. No official patch or remediation level has been published by the vendor as of the provided data.

The vulnerability allows authenticated users with Author-level access or above to perform SSRF attacks, enabling them to send arbitrary requests from the server to internal or external systems. This can lead to unauthorized information disclosure or modification of internal services. There is no indication of direct denial of service or remote code execution impact. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to the save_ai_generated_image() function. Avoid exposing sensitive internal services that could be targeted via SSRF.