PT-2025-6722 · Unknown · Seventhqueen K Elements

Rafie Muhammad · Published 2025-02-18 · Updated 2025-02-22 · CVE-2024-56000

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions SeventhQueen K Elements versions prior to 5.4.0

Description The issue is related to an Incorrect Privilege Assignment vulnerability, which allows Privilege Escalation. This vulnerability potentially affects over 23,000 sites. It has been reported that this issue is being actively exploited.

Recommendations For versions prior to 5.4.0, update to version 5.4.0 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive areas of the application to minimize the risk of exploitation.

Fix

LPE

Incorrect Privilege Assignment

Weakness Enumeration

CWE-266

Related Identifiers

CVE-2024-56000

Affected Products

Seventhqueen K Elements

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2024-56000 · Security Note
• https://themeforest.net/item/kleo-pro-community-focused-multipurpose-buddypress-theme/6776630?_s_id=cve · Note
• https://twitter.com/the_yellow_fall/status/1893113765941354565 · Twitter Post
• https://twitter.com/Dinosn/status/1893145160856318339 · Twitter Post
• https://twitter.com/yeraisci_/status/1892551254536245436 · Twitter Post
• https://patchstack.com/database/wordpress/plugin/k-elements/vulnerability/wordpress-k-elements-plugin-5-2-0-unauthenticated-account-takeover-vulnerability?_s_id=cve · Note
• https://twitter.com/fridaysecurity/status/1893115320853807381 · Twitter Post
• https://twitter.com/CVEnew/status/1891944599888789897 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/k-elements/vulnerability/wordpress-k-elements-plugin-5-2-0-unauthenticated-account-takeover-vulnerability?_s_id=cve · Note
• https://twitter.com/syedaquib77/status/1893370546701901835 · Twitter Post
• https://t.me/cvenotify/111741 · Telegram Post
• https://t.me/pentestingnews/56919 · Telegram Post
• https://patchstack.com/articles/critical-privilege-escalation-patched-in-kleo-themes-plugin?_s_id=cve · Note
• https://twitter.com/CandidTodayTech/status/1892519981587284236 · Twitter Post
• https://twitter.com/CVETracker/status/1892303348407083113 · Twitter Post