// For flags

CVE-2022-4103

Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation

Severity Score

4.3
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

El complemento Royal Elementor Addons de WordPress anterior a 1.3.56 no tiene autorización ni verificaciones CSRF al crear una plantilla, y no garantiza que la publicación creada sea una plantilla. Esto podría permitir a cualquier usuario autenticado, como un suscriptor, crear una publicación (así como cualquier tipo de publicación) con un título arbitrario.

The Royal Elementor Addons plugin for WordPress is vulnerable to authorization bypass due to a missing capability check during template creation in the function wpr_create_template in versions up to, and including, 1.3.55. Furthermore, the plugin does not verify whether the created post is a template. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to create arbitrary posts and pages.

*Credits: Krzysztof Zając, WPScan
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
None
Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-11-21 CVE Reserved
  • 2022-12-15 CVE Published
  • 2024-08-01 EPSS Updated
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-352: Cross-Site Request Forgery (CSRF)
  • CWE-862: Missing Authorization
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Royal-elementor-addons
Search vendor "Royal-elementor-addons"
 Royal Elementor Addons
Search vendor "Royal-elementor-addons" for product "Royal Elementor Addons"
 < 1.3.56
Search vendor "Royal-elementor-addons" for product "Royal Elementor Addons" and version " < 1.3.56"
wordpress
Affected