Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.3
CVE-2022-4103: The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could a...
CVE-2022-4103 · published 3 years ago
Summary
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an ar...
What to do
- Update royal-elementor-addons royal_elementor_addons to version 1.3.56 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| royal-elementor-addons | royal_elementor_addons |
< 1.3.56 cpe:2.3:a:royal-elementor-addons:royal_elementor_addons:*:*:*:*:*:wordpress:*:* |
Original advisory text
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could a...
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title
References
- https://wpscan.com/vulnerability/5e1244f7-39b5-4f37-8fef-e3f35fc388f1 Exploit Third Party Advisory
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-352Cross-Site Request Forgery (CSRF)
CWE-862Missing Authorization
Timeline
Published9 Jan 2023
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2022-4103 · NVD
Track software like this
Free during beta