CVE-2025-11369: 
WordPress vulnerability analysis and mitigation

CVE-2025-11369 is a missing authorization vulnerability in the Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns plugin for WordPress. It affects all versions up to and including 5.7.2, allowing authenticated attackers with Author-level access or above to access sensitive API keys configured for external services. The vulnerability was published on December 17, 2025, and assigned a CVSS v3.1 base score of 4.3 (Medium) (Wordfence, Red Hat CVE).

The root cause is missing or incorrect capability checks (CWE-862: Missing Authorization) on three AJAX callback functions: get_instagram_access_token_callback, google_map_api_key_save_callback, and get_siteinfo. These functions, found in the plugin's Instagram.php, GoogleMap.php, and OpenVerse.php integration files, fail to verify that the requesting user has sufficient privileges before returning sensitive configuration data. Any authenticated WordPress user with Author-level access or higher can invoke these endpoints over the network without additional interaction, retrieving API keys for Instagram, Google Maps, and OpenVerse (Wordfence, ENISA EUVD).

Successful exploitation allows authenticated low-privileged users to read API keys for external services integrated with the WordPress site, including Instagram access tokens, Google Maps API keys, and OpenVerse credentials. Exposure of these keys could enable an attacker to abuse third-party service quotas, access associated external accounts, or use the keys for further reconnaissance. There is no direct impact on integrity or availability of the WordPress installation itself (Wordfence).

No public proof-of-concept exploit code or in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.026% (0.000260), indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum an authenticated Author-level WordPress account, limiting the attack surface (Wordfence, ENISA EUVD).

1. Obtain Author-level credentials: Acquire a valid WordPress account with at least Author-level privileges on the target site (e.g., through registration, phishing, or credential stuffing).
2. Identify the plugin: Confirm the target site is running the Essential Blocks plugin version ≤ 5.7.2 by checking plugin metadata or observable page-builder elements.
3. Invoke vulnerable AJAX endpoints: Send authenticated HTTP POST requests to the WordPress AJAX handler (/wp-admin/admin-ajax.php) with the appropriate action parameters targeting get_instagram_access_token_callback, google_map_api_key_save_callback, or get_siteinfo.
4. Extract API keys: Parse the JSON response returned by the server, which will contain the configured API keys (Instagram access token, Google Maps API key, or site info) due to the missing capability check.
5. Abuse extracted credentials: Use the harvested API keys to access or abuse the associated third-party services (Wordfence).

• Network: Repeated authenticated POST requests to /wp-admin/admin-ajax.php with action values of get_instagram_access_token_callback, google_map_api_key_save_callback, or get_siteinfo from Author-level user accounts, especially from unexpected IP addresses.
• Logs: WordPress access logs showing unusual frequency of AJAX requests to the above actions from low-privileged user sessions; responses containing API key data to non-administrative users.
• Application: Unexpected usage spikes or quota exhaustion on associated Google Maps, Instagram, or OpenVerse API accounts linked to the WordPress site.

Users should update the Essential Blocks plugin to version 5.7.3 or later, which addresses the missing capability checks on the affected functions. Until an update can be applied, site administrators should audit which users hold Author-level or higher roles and remove unnecessary accounts. Additionally, rotating any API keys (Instagram, Google Maps, OpenVerse) configured in the plugin is recommended if exploitation cannot be ruled out (Wordfence, Sucuri Blog).

The vulnerability was covered in Sucuri's December 2025 vulnerability patch roundup, noting it as part of a broader set of WordPress plugin issues addressed that month (Sucuri Blog). Wordfence, as the assigning CNA, published the initial advisory and technical details. General community reaction has been muted given the low severity and limited exploitation potential.