CVE-2021-4446: Essential Addons for Elementor <= 4.6.4 - Missing Authorization
First published: Wed Oct 16 2024(Updated: )
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| WPDeveloper Essential Addons for Elementor | <4.6.5 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=cve
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2021-4446?
CVE-2021-4446 has a critical severity rating due to its potential for authorization bypass.
How do I fix CVE-2021-4446?
To fix CVE-2021-4446, update the Essential Addons for Elementor plugin to version 4.6.5 or later.
What versions of Essential Addons for Elementor are affected by CVE-2021-4446?
CVE-2021-4446 affects all versions of the Essential Addons for Elementor plugin up to and including 4.6.4.
Who can exploit CVE-2021-4446?
CVE-2021-4446 can be exploited by authenticated attackers with minimal permissions, such as a subscriber.
What type of vulnerability is CVE-2021-4446?
CVE-2021-4446 is an authorization bypass vulnerability caused by missing capability checks and nonce disclosure.
- agent/title
- agent/references
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/softwarecombine
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wpdeveloper
- canonical/wpdeveloper essential addons for elementor