CVE-2022-4103

Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation

Medium · published January 9, 2023

CVSS v3.1
4.3
EPSS
0%
Percentile
17.4
In the wild
Unconfirmed
What it is

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00265 · 17.4th percentile
Published
2023-01-09T22:13Z
EPSS history
Timeline
  • 09 JAN 22:13Z
    Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation
    cvelistv5