CVE-2026-6394

Name of the Vulnerable Software and Affected Versions Nexa Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE versions prior to 1.1.2

Description An unauthenticated attacker can perform Server-Side Request Forgery (SSRF) by exploiting the import demo() function. The issue occurs because the function accepts a user-supplied URL via the demo json file POST parameter and passes it to wp remote get() without validating the URL or restricting access to internal or private network destinations. The required nexa blocks nonce for the AJAX action is publicly exposed in the HTML source of frontend pages via wp localize script on the enqueue block assets hook, bypassing authentication barriers. This allows requests to arbitrary internal or external destinations, potentially exposing localhost services, internal services, and cloud metadata endpoints like the AWS instance metadata service. Additionally, a secondary SSRF vector exists where image URLs within a manipulated JSON response are fetched through a second wp remote get() call, enabling chained exploitation.

Recommendations Update Nexa Blocks - Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE to version 1.1.2 or later. As a temporary mitigation, restrict access to the import demo() function or the demo json file parameter.