Privilege Escalation Vulnerability in PowerPack Pro for Elementor

CVE-2024-3668

Summary

The PowerPack Pro for Elementor plugin for WordPress contains a security vulnerability that allows privilege escalation through improper access control mechanisms. Specifically, low privileged users can exploit this weakness to set a default role when creating registration forms. As a result, authenticated attackers with contributor-level access, or higher, can create forms that assign themselves administrative roles upon registration, effectively compromising the site's security and integrity. This flaw is present in all versions of the plugin up to and including version 2.10.17.

References