Authorization Bypass in Jeg Elementor Kit Plugin for WordPress

CVE-2022-3794

What is CVE-2022-3794?

The Jeg Elementor Kit plugin for WordPress contains a vulnerability that allows authenticated users to bypass authorization checks due to insecure AJAX actions in versions up to 2.5.6. Because the plugin does not properly enforce capability checks, it can enable users to create and modify header templates without appropriate permissions, exposing the site to unauthorized changes and potential exploitation.

References