The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 17 Dec 2025 02:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access of data due to a missing or incorrect capability checks on the get_instagram_access_token_callback, google_map_api_key_save_callback and get_siteinfo functions in all versions up to, and including, 5.7.2. This makes it possible for authenticated attackers, with Author-level access and above, to view API keys configured for the external services. | |
| Title | Essential Blocks <= 5.7.2 - Missing Authorization To Authenticated (Author+) Information Disclosure | |
| Weaknesses | CWE-862 | |
| References |
|
|
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: Wordfence
Published:
Updated: 2025-12-17T01:48:52.052Z
Reserved: 2025-10-06T13:48:08.856Z
Link: CVE-2025-11369
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-12-17T02:16:00.780
Modified: 2025-12-17T02:16:00.780
Link: CVE-2025-11369
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses