Description
The ElementsReady Addons for Elementor WordPress plugin through 6.7.2 does not perform authorization checks that halt execution in several of its settings-save handlers, allowing users with subscriber-level access and above to overwrite the ElementsReady Addons for Elementor WordPress plugin through 6.7.2's stored settings, including its stored API credentials and its feature and template configuration.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | ElementsReady Addons for Elementor | ≤ 6.7.2 | — |
References
- https://wpscan.com/vulnerability/ed5271e4-3e8d-49b6-9118-2f4ef5116043/ exploit vdb-entry technical-description