CVE-2022-4103

MEDIUM

Royal Elementor Addons < 1.3.56 - Authenticated Missing Authorization for Template Creation

Title source: llm
STIX 2.1

Description

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

References (1)

Core 1
Core References
Exploit, Third Party Advisory exploit vdb-entry technical-description
https://wpscan.com/vulnerability/5e1244f7-39b5-4f37-8fef-e3f35fc388f1

Scores

CVSS v3 4.3
EPSS 0.0026
EPSS Percentile 17.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable no
Technical Impact partial

Details

CWE
CWE-352 CWE-862
Status published
Products (1)
royal-elementor-addons/royal_elementor_addons < 1.3.56
Published Jan 09, 2023
Tracked Since Feb 18, 2026