CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
What the vulnerability does
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Explanation of Vulnerability in Simple Terms
Jeg Kit for Elementor versions up to 2.5.6 contain a vulnerability that allows unauthenticated attackers to modify site content and access sensitive information. The vulnerability requires no user interaction and can be exploited remotely over the network. Site administrators should update to a version newer than 2.5.6 immediately.
What an attacker can do
Modify site content and access sensitive information without authentication.
Potential impact on your site
Your site's content and data can be altered or exposed by anyone on the internet without needing a password.
Conditions required to exploit
None. The attacker needs only network access; no login or user interaction required.
Key dates
External resources
Related vulnerabilities
