CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The Element Pack Elementor Addons (Header Footer, Template Library, Dynamic Grid, Carousel and Remote Arrows) plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_layouts() function in all versions up to, and including, 5.10.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to obtain a detailed listing of layout templates.
Explanation of Vulnerability in Simple Terms
Element Pack for Elementor does not properly check user permissions before allowing access to certain administrative functions. A logged-in user with low privileges can read sensitive information they should not have access to. The vulnerability affects versions up to 5.10.12. Update to a version newer than 5.10.12 to resolve this issue.
What an attacker can do
Read sensitive information restricted to higher-privilege users.
Potential impact on your site
Unauthorized users can access restricted data, potentially exposing site configuration or user information.
Conditions required to exploit
Attacker must be logged in as a low-privilege user (subscriber or contributor).
Key dates
External resources
Related vulnerabilities
