CVE-2022-3794CWE-639

Jeg Elementor Kit <= 2.5.6 - Authorization Bypass

Medium · published December 22, 2022

CVSS v3.1
5.4
EPSS
1%
Percentile
52.0
In the wild
Unconfirmed
What it is

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00683 · 52.0th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2022-12-22T20:27Z
EPSS history
Timeline
  • 22 DEC 20:27Z
    Jeg Elementor Kit <= 2.5.6 - Authorization Bypass
    cvelistv5