Unauthorized Access Vulnerability in Spexo Addons for Elementor by WordPress

CVE-2024-13335

What is CVE-2024-13335?

The Spexo Addons for Elementor plugin for WordPress is susceptible to unauthorized access as it lacks proper capability checks in the tmpcoder_theme_install_func() function. All versions up to and including 1.0.14 are affected, allowing authenticated attackers with Subscriber-level access or higher to install themes without adequate permissions. This vulnerability poses a risk to the security integrity of WordPress sites utilizing this plugin, emphasizing the need for prompt updates and security measures.

References