CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_import_templates_kit' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to import preset site configuration templates including images and settings.
Explanation of Vulnerability in Simple Terms
Royal Addons for Elementor contains an access control flaw that allows authenticated users to modify site content or availability. A logged-in user with low privileges can alter data or disrupt service without requiring additional user interaction. The vulnerability affects versions up to 1.3.59. Site administrators should update the plugin to a version newer than 1.3.59.
What an attacker can do
Modify site content or cause service disruption as an authenticated low-privilege user.
Potential impact on your site
Authenticated users can alter page content or cause the site to become unavailable without authorization.
Conditions required to exploit
Attacker must have a valid login account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
