CVE-2023-2087: CSRF
First published: Fri Jun 09 2023(Updated: )
The Essential Blocks plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.0.6. This is due to missing or incorrect nonce validation on the save function. This makes it possible for unauthenticated attackers to change plugin settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wpdeveloper Essential Blocks | <=4.0.6 |
Remedy
https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.0.6/includes/Admin/Admin.php
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/essential-blocks/tags/4.0.6/includes/Admin/Admin.php
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2900595%40essential-blocks%2Ftrunk&old=2900029%40essential-blocks%2Ftrunk&sfp_email=&sfph_mail=#file2
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d38d41c7-8786-4145-9591-3e24eff3b79c?source=cve
Frequently Asked Questions
What is the vulnerability ID for the Essential Blocks plugin in WordPress?
The vulnerability ID for the Essential Blocks plugin in WordPress is CVE-2023-2087.
What is the severity of CVE-2023-2087?
The severity of CVE-2023-2087 is medium with a severity value of 4.3.
Which version of the Essential Blocks plugin for WordPress is affected by CVE-2023-2087?
The Essential Blocks plugin for WordPress versions up to and including 4.0.6 are affected by CVE-2023-2087.
What is the cause of CVE-2023-2087?
The cause of CVE-2023-2087 is missing or incorrect nonce validation on the save function of the Essential Blocks plugin.
How can unauthenticated attackers exploit CVE-2023-2087 in the Essential Blocks plugin for WordPress?
Unauthenticated attackers can change plugin settings via forged requests exploiting CVE-2023-2087 in the Essential Blocks plugin for WordPress.
- collector/nvd-index
- agent/type
- agent/remedy
- agent/softwarecombine
- agent/severity
- agent/weakness
- agent/references
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/tags
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/trending
- vendor/wpdeveloper
- canonical/wpdeveloper essential blocks
- version/wpdeveloper essential blocks/4.0.6