CVE-2022-3805

HIGH EXPLOITED NUCLEI

Jeg Elementor Kit <2.5.6 - Auth Bypass

Title source: llm

Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.

Nuclei Templates (1)

Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update
HIGHVERIFIEDby DhiyaneshDk,popcorn94
Shodan: http.html:"/wp-content/plugins/jeg-elementor-kit"
FOFA: body="/wp-content/plugins/jeg-elementor-kit/"

References (4)

Scores

CVSS v3 8.6
EPSS 0.0848
EPSS Percentile 92.4%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

VulnCheck KEV 2023-01-03
CWE
CWE-639
Status published
Products (2)
jegtheme/jeg_elementor_kit < 2.5.7
jegtheme/Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress < 2.5.6
Published Dec 22, 2022
Tracked Since Feb 18, 2026