WordPress Plugin Vulnerabilities

Testimonial Carousel For Elementor < 10.2.1 - Missing Authorization to Limited Setting Update

Description

The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option_callback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated attackers to update the OpenAI API key, disabling the feature.

Affects Plugins

Plugin icon
testimonials-carousel-elementor
Fixed in 10.2.1

References

CVE
CVE-2024-4858
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/1f589345-a081-4d27-ac4a-6edc44b96f91

Classification

Type
NO AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-862
CVSS
5.3 (medium)

Miscellaneous

Original Researcher
Francesco Carlucci
Verified
No
WPVDB ID
6494d577-dd71-42aa-ac87-a96a8d2e09bc

Timeline

Publicly Published
2024-05-24 (about 2 years ago)
Added
2024-05-24 (about 2 years ago)
Last Updated
2024-05-25 (about 2 years ago)

Other

Published
Title
Published
2025-07-04
Title
fluXtore < 1.6.3 - Missing Authorization
Published
2024-06-20
Title
Smush < 3.16.5 - Subscriber+ Resmush List Deletion
Published
2025-02-19
Title
Gift Cards (Gift Vouchers and Packages) (WooCommerce Supported) < 4.5.0 - Missing Authorization to Unauthenticated Price, Date, and Note Updates
Published
2023-11-27
Title
Qode Essential Addons < 1.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation/Activation
Published
2025-08-25
Title
Taxi Booking Manager for WooCommerce < 1.3.1 - Missing Authorization