CVE-2022-4708
First published: Tue Jan 10 2023(Updated: )
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.
Credit: security@wordfence.com security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Royal Elementor Addons | <=1.3.59 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217
- https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def
Frequently Asked Questions
What is the severity of CVE-2022-4708?
The severity of CVE-2022-4708 is medium.
Which version of the Royal Elementor Addons plugin is affected by CVE-2022-4708?
Versions up to and including 1.3.59 of the Royal Elementor Addons plugin are affected by CVE-2022-4708.
What is the vulnerability in the Royal Elementor Addons plugin for WordPress?
The vulnerability in the Royal Elementor Addons plugin for WordPress is insufficient access control in the 'wpr_save_template_conditions' AJAX action.
Who can exploit the vulnerability in the Royal Elementor Addons plugin?
Any authenticated user, including those with subscriber-level permissions, can exploit the vulnerability in the Royal Elementor Addons plugin.
How can the vulnerability in the Royal Elementor Addons plugin be fixed?
To fix the vulnerability in the Royal Elementor Addons plugin, update to a version higher than 1.3.59.
- agent/type
- agent/severity
- agent/weakness
- agent/references
- agent/description
- agent/first-publish-date
- agent/author
- agent/softwarecombine
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/royal-elementor-addons
- canonical/royal elementor addons
- version/royal elementor addons/1.3.59