WordPress Plugin Vulnerabilities

Royal Elementor Addons < 1.7.1002 - Missing Authorization

Description

The plugin is vulnerable to unauthorized access due to a missing capability check on a function. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
royal-elementor-addons
Fixed in 1.7.1002

References

CVE
CVE-2024-56227
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/f7f9b1ef-2efc-4d88-bff8-e0dd711b85ab

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
2.7 (low)

Miscellaneous

Original Researcher
Rafie Muhammad
Verified
No
WPVDB ID
5860390b-5ae8-4cb9-9b17-45ad050e94ac

Timeline

Publicly Published
2024-12-19 (about 1 year ago)
Added
2025-01-13 (about 1 year ago)
Last Updated
2025-01-13 (about 1 year ago)

Other

Published
Title
Published
2025-12-15
Title
OneSignal – Web Push Notifications < 3.6.2 - Missing Authorization to Unauthenticated Plugin Settings Update
Published
2023-09-18
Title
Legal Pages < 1.3.8 - Missing Authorization on 'deleteLegalTemplate'
Published
2025-09-23
Title
Super Blank < 1.3.0 - Authenticated (Subscriber+) Arbitrary Content Deletion
Published
2025-11-29
Title
Quick Interest Slider <= 3.1.5 - Missing Authorization
Published
2023-12-27
Title
BuddyBoss Theme < 2.4.61 - Missing Authorization