Authorization Bypass in Jeg Elementor Kit Plugin for WordPress
CVE-2022-3805
8.6HIGH
Summary
The Jeg Elementor Kit plugin for WordPress is susceptible to an authorization bypass issue, found in versions up to and including 2.5.6. This vulnerability allows unauthenticated users to exploit accessible nonces from plugin-edited pages to manipulate key settings. Specifically, attackers can update the MailChimp API key, global styles, 404 page settings, and enabled elements, potentially leading to unauthorized changes to the website’s functionalities.
Affected Version(s)
Jeg Elementor Kit * <= 2.5.6
References
CVSS V3.1
Score:
8.6
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved
Credit
Ramuel Gall