Insufficient Access Control in Royal Elementor Addons Plugin for WordPress
CVE-2022-4708
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Vendor
- CVE Published:
- 10 January 2023
What is CVE-2022-4708?
The Royal Elementor Addons plugin for WordPress exhibits a significant vulnerability due to insufficient access control within the 'wpr_save_template_conditions' AJAX action. This flaw, present in versions up to and including 1.3.59, permits any authenticated user, regardless of their permission level, to alter template display conditions. Such unauthorized modifications could lead to security breaches and compromised site integrity.
Affected Version(s)
Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets) * <= 1.3.59