CVE-2023-2083, CVE-2023-2084, CVE-2023-2085, CVE-2023-2086, CVE-2023-2087

The Essential Blocks plugin for WordPress through version 4.0.6 allows subscribers to save plugin settings due to an absent capability verification in the save function. Although the code includes nonce validation, this check only runs when a nonce is actually supplied, meaning requests without a nonce bypass the verification entirely. The absence of a capability check compounds this issue, enabling unauthorized users to modify plugin configurations.

Based on public CVE data (MITRE/NVD).