8.8

CVE-2021-4447

Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation

Essential Addons for Elementor <= 4.6.4 - Authenticated (Contributor+) Privilege Escalation

The Essential Addons for Elementor  plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user.
Mögliche Gegenmaßnahme
Essential Addons for Elementor – Popular Elementor Templates & Widgets: Update to version 4.6.5, or a newer patched version
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Wpdeveloper ≫ Essential Addons For Elementor SwEditionlite SwPlatformwordpress Version < 4.6.5
Weitere Schwachstelleninformationen
SystemWordPress Plugin
≫
Produkt Essential Addons for Elementor – Popular Elementor Templates & Widgets
Version *-4.6.4
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.44% 0.352
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
security@wordfence.com 8.8 2.8 5.9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=cve
Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a
Third Party Advisory