CVE-2023-4402

The Essential Blocks plugin through version 4.2.0 contains a PHP Object Injection vulnerability in the get_products function that processes unserialized user-controlled data, enabling unauthenticated attackers to inject malicious PHP objects. While the plugin itself lacks a gadget chain for exploitation, the presence of such a chain in other installed plugins or themes could be leveraged to perform dangerous actions including file deletion, information disclosure, or remote code execution.

Based on public CVE data (MITRE/NVD).