WordPress Plugin Vulnerabilities

Sticky Header Effects for Elementor < 2.1.3 - Missing Authorization

Description

The Sticky Header Effects for Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.1.3. This makes it possible for authenticated attackers, with contributor-level access and above, to perform an unauthorized action.

Affects Plugins

Plugin icon
sticky-header-effects-for-elementor
Fixed in 2.1.3

References

CVE
CVE-2025-58251
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/5b98173e-0b89-44f9-a238-34a36ed422ac

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.4 (medium)

Miscellaneous

Original Researcher
Peter Thaleikis
Verified
No
WPVDB ID
63b3d03c-960e-4c0a-895a-127c39e31fc9

Timeline

Publicly Published
2025-09-22 (about 7 months ago)
Added
2025-09-26 (about 7 months ago)
Last Updated
2025-10-30 (about 6 months ago)

Other

Published
Title
Published
2024-09-24
Title
Revolut Gateway for WooCommerce < 4.17.4 - Missing Authorization to Unauthenticated Order Status Update
Published
2025-12-16
Title
Converter for Media < 6.4.0 - Subscriber+ Optimized Image Deletion via regenerate-attachment REST Endpoint
Published
2025-06-09
Title
Membership For WooCommerce < 2.8.2 - Missing Authorization
Published
2026-02-13
Title
Mogi <= 1.2.3 - Missing Authorization
Published
2024-04-16
Title
WP Cookie Consent ( for GDPR, CCPA & ePrivacy ) < 3.1.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion