CVE-2021-4445CWE-862

Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update

Medium · published October 16, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
35.1
In the wild
Unconfirmed
What it is

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00419 · 35.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2024-10-16T06:43Z
EPSS history
Timeline
  • 16 OCT 06:43Z
    Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
    cvelistv5