CVE-2023-5922

Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read

High · published January 16, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
53.0
In the wild
Unconfirmed
What it is

The Royal Elementor Addons and Templates WordPress plugin before 1.3.81 does not ensure that users accessing posts via an AJAX action (and REST endpoint, currently disabled in the plugin) have the right to do so, allowing unauthenticated users to access arbitrary draft, private and password protected posts/pages content

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00710 · 53.0th percentile
Published
2024-01-16T15:57Z
EPSS history
Timeline
  • 16 JAN 15:57Z
    Royal Elementor Addons and Templates < 1.3.81 - Unauthenticated Arbitrary Post Read
    cvelistv5