Cross-Site Request Forgery in Essential Blocks Plugin for WordPress
CVE-2023-2087

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates
Vendor
CVE Published:
9 June 2023

Summary

The Essential Blocks plugin for WordPress is susceptible to Cross-Site Request Forgery due to missing or incorrect nonce validation on its save function. This vulnerability allows unauthenticated attackers to alter plugin settings by tricking site administrators into performing unintended actions, such as clicking a malicious link. Users should update to the latest version and implement security best practices to mitigate potential risks.

Affected Version(s)

Essential Blocks – Page Builder Gutenberg Blocks, Patterns & Templates * <= 4.0.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/essential-bloc...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Marco Wotschka
.