CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Elementor Addons, Widgets and Enhancements – Stax plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the toggle_widget function in versions up to, and including, 1.4.3. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to enable or disable Elementor widgets.
Explanation of Vulnerability in Simple Terms
Stax Addons for Elementor versions up to 1.4.3 lack proper authorization checks on certain administrative functions. A logged-in user with low privileges can modify site settings or content without the required permissions. The vulnerability requires an active user account but no special interaction from the victim.
What an attacker can do
Modify site settings or content without proper authorization as a low-privilege user.
Potential impact on your site
Unauthorized users can alter site configuration or content, potentially defacing the site or changing settings.
Conditions required to exploit
Attacker must have a valid user account with low privileges on the site.
Key dates
External resources
Related vulnerabilities
