Design/Logic Flaw

2024-01-1516:15:00

PRIOn knowledge base

www.prio-n.com

essential blocks

unauthenticated attackers

local variables

file inclusion

7 High

AI Score

Confidence

Low

0.071 Low

EPSS

Percentile

94.0%

JSON

The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.

CPENameOperatorVersion
essential_blockslt4.4.3

CPE	Name	Operator	Version
	essential_blocks	lt	4.4.3

References

wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/

wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f