CVE-2023-51360 is a medium severity (CVSS 6.5) missing authorization flaw in the Essential Blocks for Gutenberg WordPress plugin, versions through 4.2.0. A Subscriber account is enough to reach it. Patchstack says to update to version 4.2.1 or later, which also covers the related CVE-2023-51359.
What's affected
Patchstack's advisory lists the Essential Blocks for Gutenberg WordPress plugin as affected in the range 4.2.0 and earlier. The record describes a missing authorization issue that allows exploiting incorrectly configured access control security levels. It is the companion of CVE-2023-51359.
Patchstack gives 4.2.1 as the fixed version and says to update to 4.2.1 or later. Patchstack says the attacker needs a Subscriber account.
CVSS for this entry is 6.5 (Medium) with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N.
How to check if you're exposed
On a WordPress site with WP-CLI installed, list the plugin and its version.
wp plugin list --name=essential-blocks --fields=name,status,version,update_version
If the version is lower than 4.2.1, the site is in the affected range. You can also read the version on the Plugins page of the WordPress dashboard. For many sites, run the command on each one or use your management console.
What to do now
- Check the installed version of Essential Blocks for Gutenberg on every site you run.
- Update to 4.2.1 or later from the Plugins page, or with wp plugin update essential-blocks.
- Test the site after the update, especially the features that rely on the plugin.
- If the plugin is no longer needed, deactivate and delete it rather than leaving it installed.
- Review the users on the site and remove accounts you do not recognize, since several plugin flaws depend on a low privilege account.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan against your manifests, and look the entry up in the Safeguard Gold directory to see how it is tracked.
Why it matters
CWE-862 is missing authorization. The code performs an action without checking whether the caller is allowed to. The fix is a capability or role check on every action that changes or reveals data.
CWE-862 is missing authorization. The plugin performs an action without checking whether the caller has the right capability. The NVD vector needs a low privilege account and shows a high integrity impact with no confidentiality or availability impact.
Subscriber is the lowest default WordPress role, and many sites let visitors register for it. That makes the practical barrier to this flaw very low on open registration sites, even though the score stays in the medium band.
The record does not mark this CVE as listed in the CISA Known Exploited Vulnerabilities catalog, and no source I read reports exploitation in the wild.
Quick check
Why is the integrity impact high here?
The vector rates it so. The record does not describe the exact action, so check Patchstack for detail.
Do I need both fixes?
One update to 4.2.1 covers both entries, per Patchstack.
Sources
Last reviewed: 19 October 2026.
