CVE-2024-37455 HIGH

CVE-2024-37455: WordPress Ultimate Addons for elementor plugin <= 1.36.31 - Privilege Escalation vulnerability

Vendor Brainstorm Force
Product Ultimate Addons for Elementor
Weakness CWE-269
Published July 9, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

8.8/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality High
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

What the vulnerability does

01Description

Improper Privilege Management vulnerability in Brainstorm Force Ultimate Addons for Elementor allows Privilege Escalation.This issue affects Ultimate Addons for Elementor: from n/a through 1.36.31.

Explanation of Vulnerability in Simple Terms

02Summary

Ultimate Addons for Elementor versions up to 1.36.31 contain a privilege management flaw that allows authenticated users with low-level permissions to perform actions reserved for administrators. An attacker with a basic user account can read sensitive data, modify site content, or disrupt service without requiring additional user interaction. Update to a version newer than 1.36.31 to resolve this issue.

What an attacker can do

03Attacker Capabilities

Read sensitive data, modify site content, or disrupt service with a low-privilege user account.

Potential impact on your site

04Site Impact

Any registered user can escalate their privileges and perform admin-level actions on your site.

Conditions required to exploit

05Prerequisites

Attacker must have a valid user account with low-level permissions on the site.

Key dates

06Disclosure timeline

July 9, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2025-13563 Lizza LMS Pro <= 1.0.3 - Unauthenticated Privilege Escalation CVE-2026-5193 Essential Addons for Elementor – Popular Elementor Templates & Widgets <= 6.5.13 - Authenticated (Author+) Limited Privilege Escalation via register_user CVE-2026-7284 Easy Elements for Elementor <= 1.4.4 - Unauthenticated Privilege Escalation via easyel_handle_register CVE-2026-9018 Easy Elements for Elementor – Addons & Website Templates <= 1.4.5 - Unauthenticated Privilege Escalation via 'custom_meta' Parameter CVE-2026-8787 Firebase Support & Chat Management <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation