CVE-2023-6623 Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion

2024-01-1515:10:40

WPScan

www.cve.org

wordpress

plugin

local file inclusion

9.5 High

AI Score

Confidence

High

0.071 Low

EPSS

Percentile

94.0%

JSON

The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.

CNA Affected

[
  {
    "vendor": "Unknown",
    "product": "Essential Blocks",
    "versions": [
      {
        "status": "affected",
        "versionType": "semver",
        "version": "0",
        "lessThan": "4.4.3"
      }
    ],
    "defaultStatus": "unaffected",
    "collectionURL": "https://wordpress.org/plugins"
  }
]