// For flags

CVE-2022-4102

Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion

Severity Score

3.1
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.

El complemento Royal Elementor Addons de WordPress anterior a 1.3.56 no tiene autorización y verifica CSRF al eliminar una plantilla y no garantiza que la publicación que se eliminará sea una plantilla. Esto podría permitir que cualquier usuario autenticado, como suscriptores, elimine publicaciones arbitrarias, asumiendo que conocen el slug relacionado.

The Royal Elementor Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check during template deletion in the function wpr_create_template in versions up to, and including, 1.3.55. Furthermore, the plugin does not verify whether the deleted post is a template. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to delete arbitrary posts and pages.

*Credits: Krzysztof Zając, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-21 CVE Reserved
  • 2022-12-15 CVE Published
  • 2024-08-01 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Royal-elementor-addons
Search vendor "Royal-elementor-addons"
 Royal Elementor Addons
Search vendor "Royal-elementor-addons" for product "Royal Elementor Addons"
 < 1.3.56
Search vendor "Royal-elementor-addons" for product "Royal Elementor Addons" and version " < 1.3.56"
wordpress
Affected