The Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin, when run on WordPress, contains a server‑side request forgery vulnerability triggered by the save_ai_generated_image() function. An authenticated attacker with Author user role or higher can cause the server to issue arbitrary HTTP requests to any target reachable from the web application, potentially leaking or altering internal data. The weakness is classified as CWE‑918, indicating that the flaw arises from insufficient validation of user‑controlled request parameters that construct outgoing requests.

All installations of the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin up to and including version 6.1.3 are affected. This includes site deployments with WordPress running any of those plugin releases, where the attacker must first authenticate as an Author or higher.

The CVSS score is 7.2, denoting a high severity impact. EPSS is not available, so no current exploitation probability can be measured. The vulnerability is not recorded in the CISA KEV catalog. Attackers must be authenticated, meaning they need to compromise or elevate to at least Author level. Once privileged, they can bind requests to internal services, modifying or reading sensitive data. Given the high severity and the necessity of authentication, administrators should treat this as a critical issue when the plugin is deployed.