Description
The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Essential Blocks | < 4.4.3 | 4.4.3 |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Essential Blocks < 4.4.3 - Local File Inclusion http/cves/2023/CVE-2023-6623.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
References
- https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f exploit vdb-entry technical-description
- https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/