4.3
CVE-2023-2083
- EPSS 0.57%
- Veröffentlicht 09.06.2023 06:16:02
- Zuletzt bearbeitet 08.04.2026 19:18:11
- Quelle security@wordfence.com
- CVE-Watchlists
- Unerledigt
LoginEssential Blocks <= 4.0.6 - Missing Authorization via save
Essential Blocks <= 4.0.6 - Missing Authorization via save
The Essential Blocks plugin for WordPress is vulnerable to unauthorized use of functionality due to a missing capability check on the save function in versions up to, and including, 4.0.6. This makes it possible for subscriber-level attackers to save plugin settings. While a nonce check is present, it is only executed when a nonce is provided. Not providing a nonce results in the nonce verification to be skipped. There is no capability check.
Mögliche Gegenmaßnahme
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns: Update to version 4.0.7, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpdeveloper ≫ Essential Blocks SwPlatformwordpress Version <= 4.0.6
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt
Gutenberg Essential Blocks – Page Builder for Gutenberg Blocks & Patterns
Version
*-4.0.6
| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.57% | 0.425 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| nvd@nist.gov | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
| security@wordfence.com | 4.3 | 2.8 | 1.4 |
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
|
CWE-862 Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.0.6/includes/Admin/Admin.php
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2900595%40essential-blocks%2Ftrunk&old=2900029%40essential-blocks%2Ftrunk&sfp_email=&sfph_mail=#file2
https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bf0933-1c97-4374-b323-c55b91fe4d27?source=cve
https://www.wordfence.com/threat-intel/vulnerabilities/id/f8bf0933-1c97-4374-b323-c55b91fe4d27