PT-2021-23592

Name of the Vulnerable Software and Affected Versions WordPress affected versions not specified Description The issue allows users with the edit posts capability to import blocks onto any page using the "astra-page-elementor-batch-process" AJAX action. An attacker can craft and host a block...

CVE-2021-42360: Improper Access Control

On sites that also had the Elementor plugin for WordPress installed, it was possible for users with the editposts capability, which includes Contributor-level users, to import blocks onto any page using the astra-page-elementor-batch-process AJAX action. An attacker could craft and host a block...