CVE-2022-4103 - Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation · CoreCVE

Back Back to CVE browser

MEDIUM

Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Creation

Published Jan 9, 2023

4.3

MEDIUM

CVSS 3.1

EPSS 0.26%

Description

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorisation and CSRF checks when creating a template, and does not ensure that the post created is a template. This could allow any authenticated users, such as subscriber to create a post (as well as any post type) with an arbitrary title

Affected products

Remediation

No remediation recorded yet.

Weaknesses (2)

CWE-352

CSRF

CWE-862

Missing Authorization

References (1)

https://wpscan.com/vulnerability/5e1244f7-39b5-4f37-8fef-e3f35fc388f1
exploitvdb-entrytechnical-descriptionThird Party Advisory

Link	Providers	Tags
https://wpscan.com/vulnerability/5e1244f7-39b5-4f37-8fef-e3f35fc388f1		exploitvdb-entrytechnical-descriptionThird Party Advisory

Change history (0)

No recorded changes yet.

Sources

CVE.org / MITRE

Status PUBLISHED

Assigner WPScan

Published Jan 9, 2023

Updated Apr 9, 2025

Reserved Nov 21, 2022

Link CVE-2022-4103

CISA Vulnrichment

Updated Apr 9, 2025

Status Modified

Modified Jun 17, 2026

Link CVE-2022-4103

Severity n/a

Public date n/a

Links CVE-2022-4103