CVE-2022-3805: Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-3805?
The severity of CVE-2022-3805 is classified as high due to the potential for unauthorized access and modification of plugin settings.
How do I fix CVE-2022-3805?
To fix CVE-2022-3805, update the Jeg Elementor Kit plugin to version 2.5.7 or later.
Who is affected by CVE-2022-3805?
Users of the Jeg Elementor Kit plugin for WordPress versions up to and including 2.5.6 are affected by CVE-2022-3805.
What types of functions are vulnerable in CVE-2022-3805?
CVE-2022-3805 affects various functions used for updating plugin settings that lack proper authorization checks.
Can unauthenticated users exploit CVE-2022-3805?
Yes, unauthenticated users can exploit CVE-2022-3805 to modify MailChimp settings due to the authorization bypass.