Unauthorized Functionality Access in Essential Blocks Plugin for WordPress

CVE-2023-2084

What is CVE-2023-2084?

The Essential Blocks plugin for WordPress has a vulnerability that permits unauthorized access to critical plugin settings. This issue arises due to a missing capability check on the get function in all versions up to and including 4.0.6. Although a nonce check exists, it is only enforced when a nonce token is supplied. If no nonce is provided, the verification process is bypassed entirely, exposing sensitive functionalities to subscriber-level attackers. Website administrators should ensure they are using updated versions to mitigate any potential risks.

References