CVE-2024-0835
First published: Mon Feb 05 2024(Updated: )
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Credit: security@wordfence.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Royal Elementor Addons | <=1.0.116 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://www.wordfence.com/threat-intel/vulnerabilities/id/603b6c52-48eb-4e8c-a2c1-77b12a2b1a2c?source=cve
- https://wordpress.org/themes/royal-elementor-kit/
- https://themes.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=216524%40royal-elementor-kit&new=216524%40royal-elementor-kit&sfp_email=&sfph_mail=
Frequently Asked Questions
What is the severity of CVE-2024-0835?
CVE-2024-0835 is considered a medium severity vulnerability as it allows authenticated attackers to perform unauthorized actions.
How do I fix CVE-2024-0835?
To fix CVE-2024-0835, you should update the Royal Elementor Kit theme to version 1.0.117 or later.
Who is affected by CVE-2024-0835?
CVE-2024-0835 affects users of the Royal Elementor Kit theme for WordPress in versions up to and including 1.0.116.
What type of attack does CVE-2024-0835 enable?
CVE-2024-0835 enables authenticated attackers with subscriber access or higher to perform unauthorized arbitrary transient updates.
Is there a workaround for CVE-2024-0835?
There is no known workaround for CVE-2024-0835, so upgrading to the latest version is the recommended solution.
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- agent/remedy
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/royal-elementor-addons
- canonical/royal elementor addons
- version/royal elementor addons/1.0.116