by Kastro
Paper/Archive/CVE-2023-6623

CVE-2023-6623

Unknown Essential Blocks — Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion

EPSS 51%public exploitCVSS 9.8
critical.is priorityof 100
59
CVSS 9.8 (ADP, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 98.9.989 × 2019.8Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.

Affected

ProductAffectedFixed inSource
Essential Blocks< 4.4.34.4.3CNA

Scores by source

CISA ADP9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitwpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41frefwpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3