CVE-2022-3805
High
Description
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
SeverityHigh
CVSS8.6
Exploit probability—
ProductJegtheme Jeg Elementor Kit
PublishedDec 22, 2022
First seenDec 22, 2022
How to fix
Update
- jegtheme jeg_elementor_kit2.5.7 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jegtheme jeg_elementor_kit | v < 2.5.7 | 2.5.7 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.