Arbitrary Option Updates Vulnerability in Premium Addons for Elementor

CVE-2021-4445

Summary

The Premium Addons for Elementor plugin for WordPress has a vulnerability that stems from inadequate capability and nonce checks within the pa_dismiss_admin_notice AJAX action. This flaw allows authenticated users with subscriber-level access and above to alter arbitrary options of vulnerable WordPress installations. Such unauthorized modifications can lead to potential website misconfigurations and could open avenues for further attacks, emphasizing the importance of keeping the plugin updated and monitoring user permissions regularly.

References