Unauthorized Access in Essential Blocks Plugin for WordPress
CVE-2023-2086
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 9 June 2023
What is CVE-2023-2086?
The Essential Blocks plugin for WordPress has a vulnerability that allows unauthorized users to exploit a missing capability check in the template_count function. This issue is present in versions up to and including 4.0.6. Although there is a nonce check in place, it is ineffective if a nonce is not supplied, allowing attacker access to sensitive plugin template information without proper verification.
Affected Version(s)
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 4.0.6