CVE-2021-4445: Premium Addons for Elementor <= 4.5.1 - Authenticated (Subscriber+) Limited Arbitrary Option Update
The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the padismissadminnotice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2021-4445?
CVE-2021-4445 has a medium severity rating due to its potential for arbitrary option updates.
How do I fix CVE-2021-4445?
To fix CVE-2021-4445, update the Premium Addons for Elementor plugin to a version higher than 4.5.1.
What versions of Premium Addons for Elementor are affected by CVE-2021-4445?
CVE-2021-4445 affects all versions of the Premium Addons for Elementor plugin up to and including version 4.5.1.
Can authenticated users exploit CVE-2021-4445?
Yes, CVE-2021-4445 can be exploited by authenticated users with subscriber or higher privileges.
What is the vulnerability type of CVE-2021-4445?
CVE-2021-4445 is classified as an Arbitrary Option Update vulnerability.