CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
What the vulnerability does
The Easy Elements for Elementor – Addons & Website Templates plugin for WordPress is vulnerable to privilege escalation via user registration in all versions up to, and including, 1.4.4. This is due to the 'easyel_handle_register' function not restricting what user roles a user can register with. This makes it possible for unauthenticated attackers to supply the 'administrator' role during registration and gain administrator access to the site.
Explanation of Vulnerability in Simple Terms
Easy Elements for Elementor versions up to 1.4.4 contain a privilege management flaw that allows unauthenticated attackers to read, modify, or delete site data over the network without user interaction. The vulnerability stems from improper access controls that fail to restrict sensitive operations. Site administrators should update immediately to a version newer than 1.4.4.
What an attacker can do
Read, modify, or delete site data without authentication or user interaction.
Potential impact on your site
Attackers can compromise site integrity, steal data, or cause service disruption without needing valid credentials.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
