Insufficient Access Control in Royal Elementor Addons for WordPress
CVE-2022-4703

4.3MEDIUM

Key Information:

Vendor
Wordpress
Status
Royal Elementor Addons (elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & Other Free Elementor Widgets)
Vendor
CVE Published:
10 January 2023

Summary

The Royal Elementor Addons plugin for WordPress contains a vulnerability due to insufficient access control in the 'wpr_reset_previous_import' AJAX action. This flaw enables authenticated users, including those with the lowest permission levels (such as subscribers), to reset previously imported data without proper authorization. As a result, unauthorized users can potentially manipulate site data, which poses risks for site integrity and security.

Affected Version(s)

Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) * <= 1.3.59

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/royal-elemento...
https://www.wordfence.com/blog/2023/01/eleven-vulnerabili...

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ramuel Gall
.