Description
The News Kit Addons For Elementor WordPress plugin before 1.4.9 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-level access and above to install and activate a specific News Kit Addons For Elementor WordPress plugin before 1.4.9 from the WordPress.org repository.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | News Kit Addons For Elementor | < 1.4.9 | 1.4.9 |
References
- https://wpscan.com/vulnerability/36f192be-f684-494c-8b37-9dd006407b6f/ exploit vdb-entry technical-description