CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Royal Elementor Addons and Templates plugin for WordPress is vulnerable to unauthorized post metadata update due to a missing capability check on the wpr_update_form_action_meta function in all versions up to, and including, 1.3.87. This makes it possible for unauthenticated attackers to update certain metadata.
Explanation of Vulnerability in Simple Terms
Royal Addons for Elementor versions up to 1.3.87 contain a cross-site request forgery (CSRF) vulnerability that allows attackers to perform unauthorized actions on behalf of site administrators without their knowledge. The vulnerability requires no authentication and can be exploited by tricking an admin into visiting a malicious page. This could lead to unwanted changes to site settings or content.
What an attacker can do
Trick a site admin into performing unwanted actions, such as modifying settings or content, without their consent.
Potential impact on your site
Attackers can modify site settings, content, or configurations if they trick an admin into clicking a malicious link.
Conditions required to exploit
An admin must visit a page controlled by the attacker while logged into the WordPress site.
Key dates
External resources
Related vulnerabilities
