Lucene search
WPScanCVELIST:CVE-2022-4102HistoryJan 09, 2023 - 10:13 p.m.
CVE-2022-4102 Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion
2023-01-0922:13:40
WPScan
www.cve.org
cve-2022-4102
royal elementor addons
wordpress plugin
authorization
csrf
deletion
template
post
authenticated users
subscribers
slug
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
CNA Affected
[
{
"vendor": "Unknown",
"product": "Royal Elementor Addons (Elementor Templates, Post Grid, Mega Menu & Header Footer Builder, WooCommerce Builder, Product Grid, Slider, Parallax Image & other Free Elementor Widgets)",
"versions": [
{
"status": "affected",
"versionType": "custom",
"version": "0",
"lessThan": "1.3.56"
}
],
"defaultStatus": "unaffected",
"collectionURL": "https://wordpress.org/plugins"
}
]Related
cve
cve
CVE-2022-4102
2023-01-09 23:15:27
prion
prion
Cross site request forgery (csrf)
2023-01-09 23:15:00
nvd
nvd
CVE-2022-4102
2023-01-09 23:15:27
openvas
openvas