The Nexa Blocks plugin for WordPress contains a blind SSRF vulnerability in its import_demo() function. The plugin accepts a user‑supplied URL via the demo_json_file POST parameter and forwards it directly to wp_remote_get() without validating or restricting the target address. Because the nonce required for the AJAX action is publicly exposed in the front‑end markup, any visitor can trigger this endpoint, bypassing any intended authentication. This allows an attacker to instruct the server to fetch arbitrary internal or external URLs, potentially exposing web‑accessible services, cloud metadata endpoints, and other private resources. The vulnerability also includes a secondary SSRF vector where image URLs extracted from a crafted JSON response are subsequently fetched by a second wp_remote_get() call, enabling chained exploitation.

WordPress sites running Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE plugin version 1.1.1 or earlier are affected. This applies to any site where the plugin is active, regardless of the server’s network configuration.

The CVSS score of 5.4 indicates a moderate severity issue. Because the nonce is publicly exposed and the SSRF endpoint can target any network destination, an unauthenticated attacker can easily exploit the flaw to reach internal services. The EPSS score is not available, so the exact exploitation probability is uncertain, but the lack of authentication and the broad reach of the SSRF flag a realistic threat. The vulnerability is not listed in CISA’s KEV catalog, yet SSRF attacks are common and the plugin’s popularity increase the potential impact.