First published: Wed Nov 15 2023(Updated: )
The Elementor Addon Elements plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.12.7. This is due to missing or incorrect nonce validation on the eae_save_config function. This makes it possible for unauthenticated attackers to change configuration settings for the plugin via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
|Affected Software||Affected Version||How to fix|
|Webtechstreet Elementor Addon Elements||<=1.12.7|
CVE-2023-4690 is a vulnerability in the Elementor Addon Elements plugin for WordPress that allows unauthenticated attackers to change configuration settings.
CVE-2023-4690 has a severity rating of 5.4, which is classified as medium.
CVE-2023-4690 affects versions up to and including 1.12.7 of the Elementor Addon Elements plugin for WordPress.
The vulnerability in CVE-2023-4690 can be exploited by unauthenticated attackers through Cross-Site Request Forgery (CSRF) attacks.
Yes, a fix for CVE-2023-4690 is available. It is recommended to update to a version of the Elementor Addon Elements plugin for WordPress that is not vulnerable.