CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.
Explanation of Vulnerability in Simple Terms
Elementor Website Builder Pro versions up to 3.11.6 lack proper authorization checks, allowing authenticated users with low privileges to perform actions restricted to higher-privilege roles. An attacker with a basic user account can read, modify, or delete sensitive site data and functionality. Update to a version newer than 3.11.6 to resolve this issue.
What an attacker can do
Read, modify, or delete site data and functionality without proper authorization.
Potential impact on your site
Unauthorized users can access and alter critical site content, settings, and data.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site.
Key dates
External resources
Related vulnerabilities
