CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in ADD-ONS.ORG PDF for Elementor Forms + Drag And Drop Template Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF for Elementor Forms + Drag And Drop Template Builder: from n/a through 5.5.1.
Explanation of Vulnerability in Simple Terms
PDF for Elementor Forms is missing authorization checks on certain operations. A logged-in user with low privileges can modify data or settings they should not have access to, potentially affecting other users or site configuration. The scope is changed, meaning the impact extends beyond the vulnerable component itself.
What an attacker can do
Modify site data or settings beyond their assigned permission level.
Potential impact on your site
Unauthorized changes to PDF forms or template settings by low-privilege users; potential data integrity issues.
Conditions required to exploit
Attacker must be logged in with a low-privilege account (e.g., subscriber or contributor).
Key dates
External resources
Related vulnerabilities
