CVE-2023-6623: Essential Blocks WordPress plugin unauthenticated local file inclusion

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityUnauthenticated remote file inclusion with a 9.8 CVSS score, high EPSS and public exploit references makes this an urgent patch target.

What it is

The Essential Blocks WordPress plugin before 4.4.3 fails to prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API. This allows crafted requests to influence template rendering and reach local file inclusion, exposing server-side files. The flaw is remotely reachable without credentials and carries a critical CVSS score of 9.8.

Impact

An attacker can read arbitrary local files from the web server, potentially exposing configuration, credentials and other sensitive data. The CVSS vector also rates high integrity and availability impact, so broader server compromise cannot be ruled out from the record alone.

Attack surface

Reached over the network through the plugin's REST API template rendering path, with no authentication and no user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). Any site running an affected version with the plugin active is exposed.

Exploitation

Not listed in CISA KEV, but EPSS is high at roughly 0.507 (98.9th percentile) and both WPScan references are tagged Exploit, indicating public exploit detail exists. No ransomware association is documented.

What to do

• Update the Essential Blocks plugin to 4.4.3 or later immediately.
• If patching cannot be done at once, deactivate or remove the plugin until it can be updated.
• Restrict or block access to the plugin's REST API endpoints at the WAF or reverse proxy where feasible.
• Run the WordPress site with least-privilege file permissions and keep sensitive files outside the web root.
• Monitor plugin advisories and re-check for a patched version if 4.4.3 is not yet applied.

Detection

• Review web server and WordPress logs for REST API requests to Essential Blocks endpoints containing path traversal sequences or unexpected file path parameters.
• Alert on requests to plugin template rendering routes from unauthenticated clients, especially unusual or encoded file references.
• Hunt for outbound or local file reads of sensitive paths (wp-config.php, /etc/passwd) correlated with plugin REST requests.
• Check installed plugin versions across the estate and flag any Essential Blocks instance below 4.4.3.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.