Atomic Edge analysis of CVE-2026-6394 (metadata-based): This vulnerability affects the Nexa Blocks plugin for WordPress, versions up to and including 1.1.1. It allows unauthenticated attackers to perform blind Server-Side Request Forgery (SSRF) through the import_demo() function, which accepts a user-supplied URL via the demo_json_file POST parameter without validation. The CVSS score is 5.4 (medium severity), with network access, high attack complexity, no privileges required, no user interaction, and a changed scope. The impact is limited to low confidentiality and low integrity leaks.
Root Cause: The import_demo() function directly passes the user-supplied demo_json_file parameter to wp_remote_get() without any URL validation or restriction against internal or private network destinations. The nonce (nexa_blocks_nonce) required by the AJAX action is exposed via wp_localize_script on the enqueue_block_assets hook, making it publicly available on any frontend page where the plugin is active. This effectively nullifies the authentication barrier, allowing unauthenticated attackers to trigger the SSRF. A secondary vector allows fetching image URLs extracted from the attacker-controlled JSON response via another wp_remote_get() call, enabling chained exploitation. Atomic Edge analysis confirms these conclusions are directly stated in the vulnerability description, as no source code was available for verification.
Exploitation: An attacker sends a POST request to /wp-admin/admin-ajax.php with action set to the plugin’s AJAX handler (likely ‘nexa_blocks_import_demo’ or similar) and the demo_json_file parameter set to a target URL, such as http://169.254.169.254/latest/meta-data/ (AWS metadata endpoint) or http://127.0.0.1:8080/ (internal service). The attacker also includes the publicly exposed nonce (nexa_blocks_nonce) which can be scraped from the frontend HTML source. The server then makes HTTP requests to these internal services and returns the response (or performs blind, out-of-band actions) via the AJAX response or error messages. A crafted JSON payload can cause additional image fetch requests to different internal hosts, expanding the attack surface.
Remediation: The plugin must validate the demo_json_file parameter by implementing a strict allowlist of permitted URLs or URL patterns (e.g., only allowing specific external demo content servers). URL validation must check the scheme (only https://), domain, and optionally path, rejecting any internal IP addresses (e.g., 127.0.0.0/8, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16) and private hostnames like ‘localhost’ or ‘*.internal’. Additionally, the nonce should be scoped to authenticated user roles, not exposed on public-facing hooks, or the AJAX handler should enforce a capability check. Without a patch from the developer, the recommended immediate action is to disable or remove the plugin.
Impact: Successful exploitation allows an unauthenticated attacker to probe internal network services, cloud metadata endpoints (AWS, GCP, Azure), and localhost services that are not intended for public access. This can leak sensitive information such as cloud instance credentials, internal application data, configuration files, or service passwords. The secondary image fetch vector increases the risk by allowing data exfiltration through chained requests. Although the CVSS confidentiality impact is low, the real-world impact can be severe depending on the target environment, potentially leading to privilege escalation or lateral movement within the cloud infrastructure.
