Vertex Addons For Elementor
Monthly
Missing authorization bypass in Vertex Addons for Elementor (WordPress plugin, all versions ≤1.6.4) allows authenticated attackers with Subscriber-level privileges to install and activate arbitrary WordPress plugins. The activate_required_plugins() function checks current_user_can('install_plugins') capability but fails to halt execution on denial, permitting installation/activation to proceed before error response is sent. CVSS 8.8 (High) reflects authenticated (PR:L) network attack enabling high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Vertex Addons for Elementor through version 1.6.4 contains an authorization bypass vulnerability that allows authenticated attackers to modify content or settings they should not have access to due to improperly configured access controls. An attacker with low-level user privileges can escalate their capabilities by exploiting the misconfigured security levels. No patch is currently available for this vulnerability.
Missing authorization bypass in Vertex Addons for Elementor (WordPress plugin, all versions ≤1.6.4) allows authenticated attackers with Subscriber-level privileges to install and activate arbitrary WordPress plugins. The activate_required_plugins() function checks current_user_can('install_plugins') capability but fails to halt execution on denial, permitting installation/activation to proceed before error response is sent. CVSS 8.8 (High) reflects authenticated (PR:L) network attack enabling high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis.
Vertex Addons for Elementor through version 1.6.4 contains an authorization bypass vulnerability that allows authenticated attackers to modify content or settings they should not have access to due to improperly configured access controls. An attacker with low-level user privileges can escalate their capabilities by exploiting the misconfigured security levels. No patch is currently available for this vulnerability.