CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
What the vulnerability does
The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 6.5.13. This is due to insufficient role validation in the 'register_user' function, which only blocks the 'administrator' role. This makes it possible for authenticated attackers, with author level access and above, to create new user accounts with elevated privileges such as editor.
Explanation of Vulnerability in Simple Terms
Essential Addons for Elementor versions up to 6.5.13 contain a privilege management flaw that allows authenticated users with low-level permissions to modify content or settings they should not have access to. The vulnerability requires a valid user account but no additional user interaction. Site administrators should update to a version newer than 6.5.13 to prevent unauthorized modifications by lower-privileged users.
What an attacker can do
Modify site content or settings beyond their assigned permission level.
Potential impact on your site
Lower-privileged users (subscribers, contributors) can alter pages, posts, or plugin settings they shouldn't access.
Conditions required to exploit
Attacker must have a valid low-privilege user account on the site.
Key dates
External resources
Related vulnerabilities
