CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
What the vulnerability does
Missing Authorization vulnerability in B.M. Rafiul Alam Elementor Timeline Widget allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elementor Timeline Widget: from n/a through 2.2.
Explanation of Vulnerability in Simple Terms
The Elementor Timeline Widget for WordPress does not properly check user permissions before allowing modifications to timeline data. A logged-in user with low privileges can alter or delete timeline content they should not have access to. The vulnerability affects versions up to 2.2. Update to a version newer than 2.2 to resolve this issue.
What an attacker can do
Modify or delete timeline content without proper authorization.
Potential impact on your site
Unauthorized users can alter or remove timeline widgets, potentially disrupting site content and user experience.
Conditions required to exploit
Attacker must be logged in to WordPress with low-level user privileges.
Key dates
External resources
Related vulnerabilities
