Authorization Bypass in Jeg Elementor Kit Plugin for WordPress
CVE-2022-3794
5.4MEDIUM
Summary
The Jeg Elementor Kit plugin for WordPress contains a vulnerability that allows authenticated users to bypass authorization checks due to insecure AJAX actions in versions up to 2.5.6. Because the plugin does not properly enforce capability checks, it can enable users to create and modify header templates without appropriate permissions, exposing the site to unauthorized changes and potential exploitation.
Affected Version(s)
Jeg Elementor Kit * <= 2.5.6
References
CVSS V3.1
Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ramuel Gall