CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
What the vulnerability does
Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.
Explanation of Vulnerability in Simple Terms
Elementor Website Builder versions up to 4.1.0 lack proper authorization checks, allowing authenticated users with low privileges to read and modify sensitive data they should not access. An attacker with a basic user account can view or alter content and settings beyond their assigned permissions. This affects the confidentiality and integrity of site data but does not impact availability.
What an attacker can do
Read and modify site data and settings beyond their assigned user role permissions.
Potential impact on your site
Unauthorized users can access and alter sensitive content, settings, or data they should not be able to modify.
Conditions required to exploit
Attacker must have a low-privilege authenticated account on the site; no user interaction required.
Key dates
External resources
Related vulnerabilities
