CVE-2023-2086

The Essential Blocks plugin contains a capability check vulnerability in its template_count function affecting versions up to 4.0.6, allowing attackers with subscriber-level access to retrieve plugin template data. Although the code includes nonce verification, this check only activates when a nonce is actually supplied, meaning requests without a nonce bypass the verification entirely. The absence of any capability restrictions means any authenticated user can exploit this flaw to access sensitive template information.

Based on public CVE data (MITRE/NVD).