CVE Daily

CVE-2022-4704

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient ac...

Medium CVSS 5.4

Overview

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.

CWE: N/A Published: 2023-01-10T17:15:11.457
Risk analysis

This vulnerability is rated 🟡 MEDIUM.

  • CVSS: 5.4 (MEDIUM)
  • Detected tags: none (tag impact: LOW)

Recommended actions:

  • Prioritize remediation based on business criticality and exposure.
  • Limit exposure and increase monitoring until fixed.

Recommended tools

Tags