CVE-2023-2086 — Essential Blocks <= 4.0.6 - Missing Authorization via template_count
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the template_count function in versions up to, …
Published: 2023-06-09 · CVSS: 4.3 · CVSS 3.1
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the template_count function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to obtain plugin template information. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7