CVE-2024-24844CWE-862

WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability

High · published December 23, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
20.1
In the wild
Unconfirmed
What it is

⚡ A sneaky missing authorization flaw in PowerPack Pro for Elementor is leaving doors wide open! 🚪✨ Think of it like a hotel with a front desk that doesn’t verify guest identities. Anyone can stroll right in and access restricted areas, leaving valuables vulnerable! An attacker could slip into your site and access sensitive areas, modify content, or even alter user permissions without breaking a sweat. If your site's security isn’t tight, they could wreak havoc before you even know what happened!

Put simply

Think of it like a hotel with a front desk that doesn’t verify guest identities. Anyone can stroll right in and access restricted areas, leaving valuables vulnerable! This vulnerability arises from incorrect access control configurations, allowing unauthorized users to bypass security checks in PowerPack Pro for Elementor, potentially leading to unauthorized access or data manipulation.

What to do

An attacker could slip into your site and access sensitive areas, modify content, or even alter user permissions without breaking a sweat. If your site's security isn’t tight, they could wreak havoc before you even know what happened! Update to version 2.10.7 or later to close this loophole. Additionally, review and strengthen your access control settings to ensure that only authorized users can access sensitive functions. Keep an eye on your configuration! You’ve got this! With these steps, you can lock down your site like a pro! 🛡️

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00287 · 20.1th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-12-23T12:06Z
EPSS history
Timeline
  • 23 DEC 12:06Z
    WordPress PowerPack Pro for Elementor plugin <= 2.10.6 - Unauthenticated Plugin Settings Reset vulnerability
    cvelistv5