Wpdive · Nexa Blocks – Gutenberg Blocks · CVE-2026-6394
**Name of the Vulnerable Software and Affected Versions**
Nexa Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 1.1.2
**Description**
An unauthenticated attacker can perform Server-Side Request Forgery (SSRF) by exploiting the `import demo()` function. The issue occurs because the function accepts a user-supplied URL via the `demo json file` POST parameter and passes it to `wp remote get()` without validating the URL or restricting access to internal or private network destinations. The required `nexa blocks nonce` for the AJAX action is publicly exposed in the HTML source of frontend pages via `wp localize script` on the `enqueue block assets` hook, bypassing authentication barriers. This allows requests to arbitrary internal or external destinations, potentially exposing localhost services, internal services, and cloud metadata endpoints like the AWS instance metadata service. Additionally, a secondary SSRF vector exists where image URLs within a manipulated JSON response are fetched through a second `wp remote get()` call, enabling chained exploitation.
**Recommendations**
Update Nexa Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to version 1.1.2 or later.
As a temporary mitigation, restrict access to the `import demo()` function or the `demo json file` parameter.