Unauthorized Data Modification in Getwid – Gutenberg Blocks Plugin for WordPress

CVE-2023-1910

Summary

The Getwid – Gutenberg Blocks plugin for WordPress is susceptible to unauthorized data modification due to inadequate capability checks in the get_remote_templates function. This vulnerability affects versions up to and including 1.8.3, allowing authenticated users with subscriber-level access or higher to flush the remote template cache. Although cached template information can be accessed through this function, it is publicly available and not deemed sensitive. This creates a risk where attackers could manipulate template cache without sufficient verification.

References