CVE-2023-0086: JetWidgets for Elementor <= 1.0.12 - Cross-Site Request Forgery to Settings Update
The JetWidgets for Elementor plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.12. This is due to missing nonce validation on the save() function. This makes it possible for unauthenticated attackers to to modify the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. This can be used to enable SVG uploads that could make Cross-Site Scripting possible.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2023-0086?
CVE-2023-0086 is classified as a medium severity vulnerability due to its potential for cross-site request forgery attacks.
How do I fix CVE-2023-0086?
To fix CVE-2023-0086, update the JetWidgets for Elementor plugin to version 1.0.13 or later which includes nonce validation for the save() function.
Who is affected by CVE-2023-0086?
Users of the JetWidgets for Elementor plugin for WordPress under version 1.0.12 are affected by CVE-2023-0086.
What type of vulnerability is CVE-2023-0086?
CVE-2023-0086 is a Cross-Site Request Forgery (CSRF) vulnerability that allows unauthenticated attackers to modify settings.
Is there a workaround for CVE-2023-0086 before updating?
There is no direct workaround for CVE-2023-0086; the best practice is to update the plugin to the latest version.