PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-6394 wpdive CVE debrief

The Nexa Blocks WordPress plugin (versions up to and including 1.1.1) contains a Server-Side Request Forgery (SSRF) vulnerability that allows unauthenticated attackers to make server-side HTTP requests to arbitrary destinations. The vulnerability stems from two weaknesses: first, the `import_demo()` function accepts a user-supplied URL via the `demo_json_file` POST parameter and passes it directly to `wp_remote_get()` without validation or restriction against internal/private network destinations; second, the `nexa_blocks_nonce` required for the AJAX action is exposed in the HTML source of any frontend page where the plugin is active via `wp_localize_script` on the `enqueue_block_assets` hook, making it available to all visitors and bypassing authentication barriers. A secondary SSRF vector exists where image URLs extracted from the attacker-controlled JSON response are subsequently fetched via a second `wp_remote_get()` call, enabling chained exploitation through crafted JSON payloads. This could expose internal services, cloud metadata endpoints (including AWS instance metadata), localhost services, and other non-public resources.

Vendor
wpdive
Product
Nexa Blocks – Gutenberg Blocks, Page Builder for Gutenberg Editor & FSE
CVSS
MEDIUM 5.4
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-20
Original CVE updated
2026-07-24
Advisory published
2026-05-20
Advisory updated
2026-07-24

Who should care

WordPress site administrators using Nexa Blocks plugin; security teams managing WordPress deployments in cloud environments (AWS, GCP, Azure); DevSecOps engineers responsible for container and VM instance metadata protection; web application firewall administrators

Technical summary

The vulnerability combines two implementation flaws: (1) cryptographic secret exposure through `wp_localize_script` making the AJAX nonce publicly accessible, and (2) lack of URL validation in `wp_remote_get()` calls. The `import_demo()` function at line 236 of `template.php` accepts arbitrary URLs, while a secondary fetch at line 242 processes image URLs from the JSON response without validation. The nonce exposure at line 84 of `enqueue-assets.php` occurs on the `enqueue_block_assets` hook, which runs on frontend pages. Attackers can chain these weaknesses to perform blind SSRF against internal infrastructure, potentially accessing cloud instance metadata services (169.254.169.254), internal APIs, or localhost services.

Defensive priority

medium

Recommended defensive actions

  • Update Nexa Blocks plugin to version 1.1.2 or later if available
  • If immediate patching is not possible, consider temporarily disabling the plugin or restricting access to WordPress admin AJAX endpoints
  • Implement network-level egress filtering to block outbound requests from the WordPress server to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.169.254/32) and link-local addresses
  • Review WordPress server IAM roles and instance metadata access configurations, particularly for cloud deployments
  • Monitor web server logs for suspicious `demo_json_file` parameters in POST requests to `/wp-admin/admin-ajax.php`
  • Apply principle of least privilege to WordPress server network access

Evidence notes

Vulnerability confirmed via WordPress plugin source code analysis. The nonce exposure is located in `enqueue-assets.php` at line 84, while the SSRF vectors are in `template.php` at lines 236 and 242. Both tagged version 1.1.1 and trunk versions contain the vulnerable code.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-6394 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-6394

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-6394 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-6394

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.