Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
58Vexday Risk Score
Corrija agora. Ela exploração observada pelo VulnCheck e tem exploit funcional público.
ssvc Actcvss 8.6epss 1.6%
da publicação à arma
Publicada no NVD22 de dez.
VulnCheck+12d
probabilidade de exploração
1.6%top 27% das CVEs
exploração observada
simVulnCheck
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L
Produtos afetados
jegtheme · Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPressReferências
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=https://wordpress.org/plugins/jeg-elementor-kit/#developershttps://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve