CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
What the vulnerability does
Improper Authentication vulnerability in Elementor Elementor Website Builder allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Elementor Website Builder: from n/a through 3.16.4.
Explanation of Vulnerability in Simple Terms
Elementor Website Builder versions up to 3.16.4 contain an authentication flaw that allows low-privileged users to read sensitive data they should not access. An attacker with a basic user account can retrieve confidential information from the site without additional interaction. This affects the confidentiality of site data but does not allow modification or deletion.
What an attacker can do
Read sensitive site data using a low-privilege user account.
Potential impact on your site
Confidential site information may be exposed to users with basic accounts.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
