{"id":"CVE-2023-6623","aliases":["EUVD-2023-58846","GHSA-phjg-gj5x-8j96"],"status":"published","title":"Essential Blocks \u003c 4.4.3 - Unauthenticated Local File Inclusion","description":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.50673,"percentile":0.98935,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-22"],"published":"2024-01-15T15:10:40Z","modified":"2026-06-17T06:51:07Z","exploits":[{"source":"nuclei","id":"CVE-2023-6623","title":"Essential Blocks \u003c 4.4.3 - Local File Inclusion","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-6623.yaml"}],"products":[{"vendor":"unknown","product":"essential blocks"},{"vendor":"wpdeveloper","product":"essential_blocks"}],"references":[{"url":"https://wpscan.com/vulnerability/633c28e0-0c9e-4e68-9424-55c32789b41f","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3/","tags":["x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-6623"},{"url":"https://wpscan.com/blog/file-inclusion-vulnerability-fixed-in-essential-blocks-4-4-3"},{"url":"https://github.com/advisories/GHSA-phjg-gj5x-8j96"}],"sources":{"cve":[{"id":"CVE-2023-6623","title":"Essential Blocks \u003c 4.4.3 - Unauthenticated Local File Inclusion","description":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.","status":"published","published":"2024-01-15T15:10:40.328Z","modified":"2025-06-11T16:37:55.499Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"updated_at":"2026-11-02T14:35:25.095989Z"}],"euvd":[{"id":"EUVD-2023-58846","description":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.","status":"published","published":"2024-01-15T15:10:40Z","modified":"2025-06-11T16:37:55Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T20:32:24.98161Z"}],"ghsa":[{"id":"GHSA-phjg-gj5x-8j96","title":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers...","description":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.","status":"published","published":"2024-01-15T18:30:18Z","modified":"2025-06-11T18:35:37Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:02:41.633611Z"}],"nvd":[{"id":"CVE-2023-6623","description":"The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks.","status":"published","published":"2024-01-15T16:15:12.573Z","modified":"2026-06-17T06:51:07.27Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:09:01.900189Z"}]}}