CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
What the vulnerability does
The Post Carousel Slider for Elementor plugin for WordPress is vulnerable to improper authorization due to a missing capability check on the process_wbelps_promo_form() function in all versions up to, and including, 1.6.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to trigger the plugin’s support‐form handler to send arbitrary emails to the site’s support address.
Explanation of Vulnerability in Simple Terms
Post Carousel Slider for Elementor versions up to 1.6.0 lack proper authorization checks, allowing authenticated users to modify carousel content they should not have access to. An attacker with a low-privilege account can alter slider settings or data without proper permission validation. Update to a version newer than 1.6.0 to resolve this issue.
What an attacker can do
Modify carousel slider content and settings without proper authorization.
Potential impact on your site
Unauthorized users can alter carousel content, potentially defacing or disrupting site appearance.
Conditions required to exploit
Attacker must have a low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
