CVE-2024-0835: Royal Elementor Kit <= 1.0.116 - Missing Authorization to Arbitrary Transient Update
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissedhandler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0835?
CVE-2024-0835 is considered a medium severity vulnerability as it allows authenticated attackers to perform unauthorized actions.
How do I fix CVE-2024-0835?
To fix CVE-2024-0835, you should update the Royal Elementor Kit theme to version 1.0.117 or later.
Who is affected by CVE-2024-0835?
CVE-2024-0835 affects users of the Royal Elementor Kit theme for WordPress in versions up to and including 1.0.116.
What type of attack does CVE-2024-0835 enable?
CVE-2024-0835 enables authenticated attackers with subscriber access or higher to perform unauthorized arbitrary transient updates.
Is there a workaround for CVE-2024-0835?
There is no known workaround for CVE-2024-0835, so upgrading to the latest version is the recommended solution.