CVE-2022-3794 MEDIUM

CVE-2022-3794: Jeg Elementor Kit <= 2.5.6 - Authorization Bypass

Vendor Jegtheme
Product Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Weakness CWE-639 · IDOR
Published December 22, 2022
Last update April 8, 2026
View on NVD All CVEs

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality Low
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

What the vulnerability does

01Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various AJAX actions in versions up to, and including, 2.5.6. Authenticated users can use an easily available nonce value to create header templates and make additional changes to the site, as the plugin does not use capability checks for this purpose.

Key dates

02Disclosure timeline

December 22, 2022 CVE published
April 8, 2026 Record updated