PT-2022-24175 · WordPress · Jeg Elementor Kit

Ram + 1 · Published 2022-12-22 · Updated 2025-09-24 · CVE-2022-3805

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions Jeg Elementor Kit plugin for WordPress versions up to, and including, 2.5.6

Description The issue allows unauthenticated users to bypass authorization and update plugin settings, including the MailChimp API key, global styles, 404 page settings, and enabled elements. This is possible due to an easily available nonce that can be obtained from pages edited by the plugin.

Recommendations For versions up to, and including, 2.5.6, update to a version later than 2.5.6 to resolve the issue. As a temporary workaround, consider restricting access to the plugin's settings pages to prevent unauthorized updates until a patch is available.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2022-3805

Affected Products

Jeg Elementor Kit

References · 8

• 🔥 https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail= · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2022-3805 · Security Note
• https://osv.dev/vulnerability/CVE-2022-3805 · Vendor Advisory
• https://wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve · Note
• https://t.me/cibsecurity/55199 · Telegram Post
• https://wordpress.org/plugins/jeg-elementor-kit/#developers · Note
• https://twitter.com/pdnuclei_bot/status/1970911145302052949 · Twitter Post