Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-4445: Premium Addons for Elementor Plugin Allows Malicious Option Changes

CVE-2021-4445 · published 2 years ago

Summary

The Premium Addons for Elementor plugin for WordPress has a security issue that allows a malicious user to change certain settings on a site by exploiting a weakness in how the plugin handles updates. This could potentially disrupt site functionality or introduce security risks. To protect your site, update the plugin to a version newer than 4.5.1.

What to do

Update leap13 premium_addons_for_elementor to version 4.5.2 or later.

Affected software

Vendor	Product	Affected versions
leap13	premium_addons_for_elementor	< 4.5.2 `cpe:2.3:a:leap13:premium_addons_for_elementor::::::wordpress::*`

Original advisory text

The Premium Addons for Elementor plugin for WordPress is vulnerable to Arbitrary Option Updates in versions up to, and including, 4.5.1. This is due to missing capability and nonce checks in the pa_dismiss_admin_notice AJAX action. This makes it possible for authenticated subscriber+ attackers to change arbitrary options with a restricted value of 1 on vulnerable WordPress sites.

References

https://ithemes.com/blog/wordpress-vulnerability-report-september-2021-part-2/#i... Mailing List Third Party Advisory
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old... Patch
https://wordpress.org/plugins/premium-addons-for-elementor/ Product
https://wpscan.com/vulnerability/2e5b3608-1dfc-468f-b3ae-12ce7c25ee6c Exploit Third Party Advisory
https://www.wordfence.com/threat-intel/vulnerabilities/id/cffb26bc-3d3f-4593-bb3... Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit
Gives an attacker partial control

Severity

4.3 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-862Missing Authorization

Timeline

Published16 Oct 2024

Updated4 Nov 2026

First seen7 Mar 2026

Sources

CVE-2021-4445 · NVD

Track software like this

Free during beta