CVE-2023-1910 in Gutenberg Blocks Plugin
Summary
by MITRE • 06/09/2023
The Getwid – Gutenberg Blocks plugin for WordPress is vulnerable to unauthorized modification of data due to an insufficient capability check on the get_remote_templates function in versions up to, and including, 1.8.3. This makes it possible for authenticated attackers with subscriber-level permissions or above to flush the remote template cache. Cached template information can also be accessed via this endpoint but these are not considered sensitive as they are publicly accessible from the developer's site.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 04/10/2026
The vulnerability identified as CVE-2023-1910 affects the Getwid Gutenberg Blocks plugin for WordPress, specifically targeting versions up to and including 1.8.3. This security flaw resides within the get_remote_templates function which lacks proper capability validation, creating an unauthorized data modification vector that can be exploited by attackers with minimal privileges. The issue stems from insufficient access controls that fail to properly verify user permissions before executing critical operations, allowing authenticated users to perform actions they should not be authorized to carry out.
The technical implementation of this vulnerability demonstrates a classic insufficient privilege check scenario where the plugin fails to validate whether the requesting user possesses adequate permissions to flush remote template caches. This capability check failure enables attackers with subscriber-level access or higher to manipulate the template cache system, potentially disrupting the normal operation of the website while maintaining persistent access. The flaw operates at the application layer within the WordPress plugin architecture, specifically targeting the plugin's remote template handling functionality.
From an operational perspective, this vulnerability creates significant risks for WordPress sites utilizing the affected plugin. Attackers can leverage this weakness to flush remote template caches, which may result in temporary service disruption or forced reloads of template data from external sources. While the cached template information itself is publicly accessible from the developer's site and therefore not considered sensitive, the ability to manipulate cache states provides attackers with additional attack surface and potential for further exploitation. The impact extends beyond simple cache manipulation as it can be used as a stepping stone for more sophisticated attacks targeting the broader WordPress ecosystem.
The vulnerability aligns with CWE-284, which describes improper access control mechanisms, and demonstrates characteristics consistent with ATT&CK technique T1078.004 related to valid accounts and privilege escalation. Organizations should prioritize immediate remediation by updating to the latest plugin version where this vulnerability has been addressed. Additionally, administrators should implement network monitoring to detect unusual cache flushing activities and consider restricting plugin functionality through custom capabilities or role modifications. The mitigation strategy should also include regular security audits of installed plugins and maintaining updated security policies that address authentication and authorization controls within WordPress environments.