What the vulnerability does
01Description
The Zita Elementor Site Library plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the import_xml_data, xml_data_import, import_option_data, import_widgets, and import_customizer_settings functions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create pages, update certain options, including WooCommerce page titles and Elementor settings, import widgets, and update the plugin's customizer settings and the WordPress custom CSS. NOTE: This vulnerability was partially fixed in version 1.6.2.
Explanation of Vulnerability in Simple Terms
02Summary
The Zita Site Library for Elementor plugin through version 1.6.2 lacks proper authorization checks on certain functions. A logged-in user with low privileges can modify site content or settings they should not have access to. The vulnerability requires an active WordPress account but no special permissions. Site administrators should update to a version newer than 1.6.2.
What an attacker can do
03Attacker Capabilities
A low-privilege logged-in user can modify site content or settings without proper authorization.
Potential impact on your site
04Site Impact
Unauthorized users may alter site content, settings, or data they should not be able to access.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with low-level permissions (e.g., subscriber or contributor role).
Key dates
06Disclosure timeline
June 25, 2024
CVE published
April 8, 2026
Record updated
