CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Borderless – Widgets, Elements, Templates and Toolkit for Elementor & Gutenberg plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'remove_zipped_font' function in all versions up to, and including, 1.5.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete icon fonts that were previously uploaded.
Explanation of Vulnerability in Simple Terms
The Borderless addon for Elementor lacks proper authorization checks, allowing authenticated users with low privileges to modify content they should not have access to. The vulnerability affects versions up to 1.5.9. An attacker needs a valid user account to exploit this issue. Site administrators should update to a version newer than 1.5.9 when available.
What an attacker can do
Modify or alter content within the Elementor page builder without proper authorization.
Potential impact on your site
Unauthorized users can alter page content, potentially defacing or corrupting your site's published pages.
Conditions required to exploit
Attacker must have a valid user account with low-level privileges on the site.
Key dates
External resources
Related vulnerabilities
