WordPress security changelog
HIGH CVE-2023-41955 Analyzed

Essential Addons for Elementor: Privilege escalation or authentication bypass

Essential Addons for Elementor is affected by privilege escalation or authentication bypass. Exposure depends on how the affected operation is made reachable by the site. A successful request can grant permissions or access that the caller should not possess.

CVE / CNA score 8.8 CVSS 3.1 · audit@patchstack.com
NVD score 8.8 CVSS 3.1 · nvd@nist.gov
Component
Essential Addons for Elementor
Plugin slug
essential-addons-for-elementor-lite
Affected
See vendor advisory
Safe version
See mitigation notes
Published
May 17, 2024
Weakness
CWE-269 — Improper Privilege Management
NVD-CWE-noinfo

This CVE was published May 17, 2024 and is one of 29 known issues for this plugin.

What to do

Patch or disable the affected component.

Update Essential Addons for Elementor to a release outside the affected range, or disable and remove it until a fixed version is available.

Source record

Technical description

Improper Privilege Management vulnerability in WPDeveloper Essential Addons for Elementor allows Privilege Escalation.This issue affects Essential Addons for Elementor: from n/a through 5.8.8.

CVE / CNA vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

Primary and upstream sources