CVE-2023-6623 is a critical local file inclusion flaw in the Essential Blocks plugin for WordPress. Before version 4.4.3, unauthenticated attackers can overwrite local variables when templates render over the REST API, which may lead to file inclusion. Update to 4.4.3 or later.
What's affected
- Product: Essential Blocks from WPDeveloper, a WordPress plugin.
- Affected: versions before 4.4.3, per the record.
- Fixed: 4.4.3. The WPScan blog post in the references describes the fix.
- Access needed: none, over the network, with low complexity (score 9.8).
The record gives a CVSS 3.1 base score of 9.8 (critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The CISA Known Exploited Vulnerabilities flag in the record is false. This post does not claim exploitation in the wild.
How to check if you're exposed
wp plugin list --fields=name,status,version
Find the plugin in the output and compare its version with the affected range above. If you do not use wp-cli, open the Plugins screen in the WordPress admin and read the version shown under the plugin name.
What to do now
- Check the Essential Blocks version on each site.
- Update to 4.4.3 or later.
- Review web logs for unusual requests to the plugin REST API routes.
- Check for new files and users if the site ran an affected version while public.
- Scan the site files for unexpected changes against a clean copy.
- Run the free in-browser dependency scan at gold.safeguard.sh/scan on any project you build that bundles this component, and keep the result next to your inventory.
Why it matters
The record maps this issue to CWE-22 (Path Traversal): A path built from user input is not confined to the intended directory, so a request can reach files elsewhere on the server.
The record lists path traversal. Templates are rendered with values that arrive in the request, and the attacker can overwrite local variables, including ones that choose which file to include. The result is that a file on the server the code never meant to load can be loaded.
The score is 9.8 because no login is required and impact on all three properties is rated high. Local file inclusion can expose files or, in some setups, run code from them. We do not describe the steps. The practical answer is a fast update and a check for signs of earlier abuse.
Try it yourself
This demo shows how to weigh severity against exploitability when deciding what to patch first.
Click through it at your own pace, or open it full screen.
Quick check
Do I need an account to be attacked?
No. The record says unauthenticated attackers can trigger it.
Is 4.4.3 the fixed version?
Yes. The record says versions before 4.4.3 are affected.
Sources
These are the references listed in the NVD record for this CVE. They were not fetched when this post was written, so confirm fixed versions in the advisory before acting.
Last reviewed: 19 October 2026.
