CVE-2021-4446

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2021-4446
The Essential Addons for Elementor plugin for WordPress is vulnerable to authorization bypass in versions up to and including 4.6.4 due to missing capability checks and nonce disclosure. This makes it possible for authenticated attackers, with minimal permissions such as a subscriber, to perform many unauthorized actions such as changing settings and installing arbitrary plugins.

6.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact LOW

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= Product
https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=cve Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*
History

10 Jan 2025, 14:46

Type Values Removed Values Added
First Time Wpdeveloper
Wpdeveloper essential Addons For Elementor
CPE cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*
References () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= - () https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail= - Product
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/283fb581-8b61-4008-a5c4-2e1490fab33e?source=cve - Third Party Advisory

16 Oct 2024, 16:38

Type Values Removed Values Added
Summary
  • (es) El complemento Essential Addons for Elementor para WordPress es vulnerable a la omisión de autorización en versiones hasta la 4.6.4 incluida debido a la falta de comprobaciones de capacidad y la divulgación de nonce. Esto hace posible que atacantes autenticados, con permisos mínimos como un suscriptor, realicen muchas acciones no autorizadas, como cambiar configuraciones e instalar complementos arbitrarios.

16 Oct 2024, 07:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-10-16 07:15

Updated : 2025-01-10 14:46

NVD link : CVE-2021-4446

Mitre link : CVE-2021-4446

CVE.ORG link : CVE-2021-4446

JSON object : View

Products Affected

wpdeveloper

  • essential_addons_for_elementor
CWE
CWE-862

Missing Authorization