CVE-2026-10586 is a Server-Side Request Forgery (SSRF) vulnerability in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns WordPress plugin. The issue affects all versions up to and including 6.1.3 and is located in the save_ai_generated_image() function. Authenticated attackers with Author-level privileges or higher can exploit this vulnerability to induce the server to make arbitrary HTTP requests to internal or external systems, potentially leading to unauthorized information disclosure or modification of internal services. No vendor advisory or patch information is currently available.

An attacker with Author-level or higher access can leverage this SSRF vulnerability to make arbitrary HTTP requests from the vulnerable server. This may allow the attacker to access or manipulate internal services that are not otherwise exposed externally, potentially leading to information disclosure or unauthorized actions within the internal network. The vulnerability does not directly impact availability but can compromise confidentiality and integrity of internal resources.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for suspicious activity related to the save_ai_generated_image() function. Avoid exposing sensitive internal services that could be targeted via SSRF.