CVE-2023-6623: Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 50.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-01-15 · updated 2026-06-17
Weakness: CWE-22

Description

The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.

Affected products

wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: before 4.4.3 — fixed in 4.4.3

How to fix

Upgrade to a fixed version: wpdevteam Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns 4.4.3. Check the vendor advisory for mitigations.

References

https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/
https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f
https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/
https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f

Get alerted when CVE-2023-6623 or the next vulnerability affects your stack