CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Explanation of Vulnerability in Simple Terms
Royal Elementor Kit versions up to 1.0.116 lack proper authorization checks, allowing authenticated users to modify content they should not have access to. An attacker with a low-privilege account can alter data through the plugin's interface. Update to a version newer than 1.0.116 to resolve this issue.
What an attacker can do
Modify or alter content in the site that their account should not have permission to change.
Potential impact on your site
Unauthorized users with basic accounts could alter page or post content, potentially defacing or corrupting your site.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the WordPress site.
Key dates
External resources
Related vulnerabilities
