The bundled Astra Notices library passed the client-supplied notice identifier straight to update_user_meta() and set_transient() when an admin notice was dismissed, without checking it against the notices the plugin had actually registered. An authenticated user could therefore overwrite arbitrary keys of their own user metadata – including WordPress’ own wp_capabilities, wp_user_level and session_tokens – and overwrite arbitrary site transients, corrupting their account or the site’s cached data. In releases before 1.6.3 the endpoint carried no capability check at all, so any logged-in user could reach it. The fix limits dismissal to registered notice IDs and rejects WordPress’ reserved user-meta keys.
This vulnerability affects the following application versions:
- Ultimate Addons for Elementor 1.2.0
- Ultimate Addons for Elementor 1.2.1
- Ultimate Addons for Elementor 1.2.2
- Ultimate Addons for Elementor 1.3.0
- Ultimate Addons for Elementor 1.3.1
- Ultimate Addons for Elementor 1.4.0
- Ultimate Addons for Elementor 1.4.1
- Ultimate Addons for Elementor 1.5.0
- Ultimate Addons for Elementor 1.5.1
- Ultimate Addons for Elementor 1.5.2
- Ultimate Addons for Elementor 1.5.3
- Ultimate Addons for Elementor 1.5.4
- Ultimate Addons for Elementor 1.5.5
- Ultimate Addons for Elementor 1.5.6
- Ultimate Addons for Elementor 1.5.7
- Ultimate Addons for Elementor 1.5.8
- Ultimate Addons for Elementor 1.5.9
- Ultimate Addons for Elementor 1.6.0
- Ultimate Addons for Elementor 1.6.1
- Ultimate Addons for Elementor 1.6.2
- Ultimate Addons for Elementor 1.6.3
- Ultimate Addons for Elementor 1.6.4
- Ultimate Addons for Elementor 1.6.5
- Ultimate Addons for Elementor 1.6.6
- Ultimate Addons for Elementor 1.6.7
- Ultimate Addons for Elementor 1.6.8
- Ultimate Addons for Elementor 1.6.9
- Ultimate Addons for Elementor 1.6.10
- Ultimate Addons for Elementor 1.6.11
- Ultimate Addons for Elementor 1.6.12
- Ultimate Addons for Elementor 1.6.13
- Ultimate Addons for Elementor 1.6.14
- Ultimate Addons for Elementor 1.6.15
- Ultimate Addons for Elementor 1.6.16
- Ultimate Addons for Elementor 1.6.17
- Ultimate Addons for Elementor 1.6.18
- Ultimate Addons for Elementor 1.6.19
- Ultimate Addons for Elementor 1.6.20
- Ultimate Addons for Elementor 1.6.21
- Ultimate Addons for Elementor 1.6.22
- Ultimate Addons for Elementor 1.6.23
- Ultimate Addons for Elementor 1.6.24
- Ultimate Addons for Elementor 1.6.25
- Ultimate Addons for Elementor 1.6.26
- Ultimate Addons for Elementor 1.6.27
- Ultimate Addons for Elementor 1.6.28
- Ultimate Addons for Elementor 1.6.29
- Ultimate Addons for Elementor 1.6.30
- Ultimate Addons for Elementor 1.6.31
- Ultimate Addons for Elementor 1.6.32
- Ultimate Addons for Elementor 1.6.33
- Ultimate Addons for Elementor 1.6.38
- Ultimate Addons for Elementor 1.6.39
- Ultimate Addons for Elementor 1.6.40
- Ultimate Addons for Elementor 1.6.41
- Ultimate Addons for Elementor 1.6.42
- Ultimate Addons for Elementor 1.6.43
- Ultimate Addons for Elementor 1.6.44
- Ultimate Addons for Elementor 1.6.45
- Ultimate Addons for Elementor 1.6.46
- Ultimate Addons for Elementor 1.6.47
- Ultimate Addons for Elementor 2.2.0