PT-2023-13945 · WordPress · Royal Elementor Addons

Krzysztof Zając · Published 2023-01-09 · Updated 2023-06-27 · CVE-2022-4102

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Royal Elementor Addons WordPress plugin versions prior to 1.3.56

Description The issue is related to the lack of authorization and CSRF checks when deleting a template, and it does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.

Recommendations For versions prior to 1.3.56, update to version 1.3.56 or later to resolve the issue. As a temporary workaround, consider restricting access to template deletion functionality to minimize the risk of exploitation.

Exploit

Fix

CSRF

Missing Authorization

Weakness Enumeration

CWE-352

CWE-862

Related Identifiers

CVE-2022-4102

Affected Products

Royal Elementor Addons

References · 6

• 🔥 https://wpscan.com/vulnerability/c177f763-0bb5-4734-ba2e-7ba816578937 · Exploit
• https://osv.dev/vulnerability/CVE-2022-4102 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-4102 · Security Note
• https://t.me/cvenotify/53148 · Telegram Post
• https://t.me/cvenotify/41644 · Telegram Post
• https://t.me/cibsecurity/56203 · Telegram Post