Authorization Bypass in Jeg Elementor Kit Plugin for WordPress

CVE-2022-3805

What is CVE-2022-3805?

The Jeg Elementor Kit plugin for WordPress is susceptible to an authorization bypass issue, found in versions up to and including 2.5.6. This vulnerability allows unauthenticated users to exploit accessible nonces from plugin-edited pages to manipulate key settings. Specifically, attackers can update the MailChimp API key, global styles, 404 page settings, and enabled elements, potentially leading to unauthorized changes to the website’s functionalities.

References