CVE-2024-3668: PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-3668?
CVE-2024-3668 has a critical severity level due to its potential for privilege escalation.
How do I fix CVE-2024-3668?
To fix CVE-2024-3668, update the PowerPack Pro for Elementor plugin to version 2.10.18 or later.
Who is affected by CVE-2024-3668?
CVE-2024-3668 affects all versions of the PowerPack Pro for Elementor plugin up to and including 2.10.17 installed on WordPress.
What type of vulnerability is CVE-2024-3668?
CVE-2024-3668 is categorized as a privilege escalation vulnerability.
Can CVE-2024-3668 allow unauthorized role changes?
Yes, CVE-2024-3668 allows low privileged users to set default roles for registration forms, leading to unauthorized role changes.