Elementsready Addons For Elementor
Monthly
Paid WooCommerce downloadable files can be retrieved without purchase on WordPress sites running ElementsReady Addons for Elementor through 6.7.2, because the plugin fails to enforce authorization on protected product download requests. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) indicates a remote, low-complexity, unauthenticated attack with no user interaction; the practical exposure is limited to stores that actually sell protected downloadable products through the plugin. Publicly available exploit code exists, and no CISA KEV status or EPSS score is provided in the supplied data.
Missing authorization in the ElementsReady Addons for Elementor WordPress plugin through version 6.7.2 allows any authenticated user at subscriber level or above to overwrite the plugin's stored settings, including saved API credentials and its feature and template configuration. The vulnerable code paths are settings-save handlers that do not halt execution when authorization fails; publicly available exploit code exists, though CISA SSVC rates exploitation as none and the flaw is not in KEV, indicating no confirmed active exploitation. Impact is confined to integrity (CVSS 4.3, PR:L, no confidentiality or availability effect), so it is a moderate, authenticated-access problem rather than an emergency - but on sites with open self-registration, an outside attacker can obtain the required subscriber account and tamper with the plugin's configuration and stored third-party credentials.
Paid WooCommerce downloadable files can be retrieved without purchase on WordPress sites running ElementsReady Addons for Elementor through 6.7.2, because the plugin fails to enforce authorization on protected product download requests. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (5.3 Medium) indicates a remote, low-complexity, unauthenticated attack with no user interaction; the practical exposure is limited to stores that actually sell protected downloadable products through the plugin. Publicly available exploit code exists, and no CISA KEV status or EPSS score is provided in the supplied data.
Missing authorization in the ElementsReady Addons for Elementor WordPress plugin through version 6.7.2 allows any authenticated user at subscriber level or above to overwrite the plugin's stored settings, including saved API credentials and its feature and template configuration. The vulnerable code paths are settings-save handlers that do not halt execution when authorization fails; publicly available exploit code exists, though CISA SSVC rates exploitation as none and the flaw is not in KEV, indicating no confirmed active exploitation. Impact is confined to integrity (CVSS 4.3, PR:L, no confidentiality or availability effect), so it is a moderate, authenticated-access problem rather than an emergency - but on sites with open self-registration, an outside attacker can obtain the required subscriber account and tamper with the plugin's configuration and stored third-party credentials.