CVE-2024-47361 MEDIUM

CVE-2024-47361: WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability

Vendor Wpvibes
Product Elementor Addon Elements
Weakness CWE-862 · Missing authorization
Published November 1, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

6.5/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.

Explanation of Vulnerability in Simple Terms

02Summary

The Elementor Addon Elements plugin for WordPress does not properly check user permissions before allowing certain actions. A logged-in user with low privileges can perform administrative operations they should not have access to, potentially disrupting site availability. Update to a version newer than 1.13.6.

What an attacker can do

03Attacker Capabilities

A low-privilege logged-in user can perform administrative actions and disrupt site availability.

Potential impact on your site

04Site Impact

Unauthorized users can perform admin-level operations, risking site downtime or unwanted configuration changes.

Conditions required to exploit

05Prerequisites

Attacker must have a low-privilege WordPress user account (e.g., subscriber or contributor).

Key dates

06Disclosure timeline

November 1, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-9233 Quiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action CVE-2026-57750 WordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability CVE-2026-12119 Simple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute CVE-2026-57334 WordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability CVE-2026-12432 Stripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter