Cross-Site Request Forgery Vulnerability in PowerPack Addons for Elementor Plugin
CVE-2023-6984
4.3MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 3 January 2024
What is CVE-2023-6984?
The PowerPack Addons for Elementor plugin, widely used in WordPress, contains a Cross-Site Request Forgery vulnerability due to inadequate nonce validation in specific files. This flaw allows unauthenticated attackers to manipulate plugin settings and potentially compromise site integrity if they can deceive a site administrator into executing a malicious request. Users should immediately assess this vulnerability to protect against unauthorized changes to their configurations.
Affected Version(s)
PowerPack Addons for Elementor (Free Widgets, Extensions and Templates) * <= 2.7.13