Up to version 4.6.4, several Essential Addons for Elementor AJAX actions check only a nonce that the plugin prints on public pages, not the user’s capability. Any logged-in user, such as a subscriber, can install and activate plugins, change the plugin’s settings and clear its asset cache.
This vulnerability affects the following application versions:
- Essential Addons for Elementor 4.3.2
- Essential Addons for Elementor 4.3.3
- Essential Addons for Elementor 4.3.4
- Essential Addons for Elementor 4.3.5
- Essential Addons for Elementor 4.3.6
- Essential Addons for Elementor 4.3.7
- Essential Addons for Elementor 4.3.8
- Essential Addons for Elementor 4.3.9
- Essential Addons for Elementor 4.4.0
- Essential Addons for Elementor 4.4.1
- Essential Addons for Elementor 4.5.0
- Essential Addons for Elementor 4.5.1
- Essential Addons for Elementor 4.5.2
- Essential Addons for Elementor 4.5.3
- Essential Addons for Elementor 4.5.4
- Essential Addons for Elementor 4.5.5
- Essential Addons for Elementor 4.6.0
- Essential Addons for Elementor 4.6.1
- Essential Addons for Elementor 4.6.2
- Essential Addons for Elementor 4.6.3
- Essential Addons for Elementor 4.6.4