Missing Authorization in template JSON import

In versions lower than4.2.1, Template_LibraryManager::import_template() unconditionally enabled unfiltered JSON upload for any caller that reached it, by adding the elementor/files/allow-file-type/json and elementor/files/allow_unfiltered_upload filters. The capability helper User::is_current_user_can_upload_json() existed but was only consulted by the editor UI to decide whether to show the “Import Templates” control — it did not guard the endpoint. The AJAX dispatcher ajax_before_action_response() likewise had no per-action check for import_template. A user without JSON-upload rights could call the import action directly and upload a crafted JSON template, defeating the intended file-type restriction.

This vulnerability affects the following application versions:

• Elementor Website Builder 3.13.2
• Elementor Website Builder 3.13.3
• Elementor Website Builder 3.13.4
• Elementor Website Builder 3.14.0
• Elementor Website Builder 3.14.0-beta1
• Elementor Website Builder 3.14.0-beta2
• Elementor Website Builder 3.14.0-beta3
• Elementor Website Builder 3.14.0-beta4
• Elementor Website Builder 3.14.0-beta5
• Elementor Website Builder 3.14.0-dev1
• Elementor Website Builder 3.14.0-dev2
• Elementor Website Builder 3.14.0-dev3
• Elementor Website Builder 3.14.0-dev4
• Elementor Website Builder 3.14.0-dev5
• Elementor Website Builder 3.14.1
• Elementor Website Builder 3.15.0
• Elementor Website Builder 3.15.0-beta1
• Elementor Website Builder 3.15.0-beta2
• Elementor Website Builder 3.15.0-beta3
• Elementor Website Builder 3.15.0-beta4
• Elementor Website Builder 3.15.0-beta5
• Elementor Website Builder 3.15.0-beta6
• Elementor Website Builder 3.15.0-dev1
• Elementor Website Builder 3.15.0-dev2
• Elementor Website Builder 3.15.0-dev3
• Elementor Website Builder 3.15.0-dev4
• Elementor Website Builder 3.15.0-dev5
• Elementor Website Builder 3.15.0-dev6
• Elementor Website Builder 3.15.1
• Elementor Website Builder 3.15.2
• Elementor Website Builder 3.15.3
• Elementor Website Builder 3.16.0
• Elementor Website Builder 3.16.0-beta1
• Elementor Website Builder 3.16.0-beta2
• Elementor Website Builder 3.16.0-beta3
• Elementor Website Builder 3.16.0-beta4
• Elementor Website Builder 3.16.0-dev1
• Elementor Website Builder 3.16.0-dev2
• Elementor Website Builder 3.16.0-dev3
• Elementor Website Builder 3.16.0-dev4
• Elementor Website Builder 3.16.1
• Elementor Website Builder 3.16.2
• Elementor Website Builder 3.16.3
• Elementor Website Builder 3.16.4
• Elementor Website Builder 3.16.5
• Elementor Website Builder 3.16.6
• Elementor Website Builder 3.17.0
• Elementor Website Builder 3.17.0-beta1
• Elementor Website Builder 3.17.0-beta2
• Elementor Website Builder 3.17.0-beta3
• Elementor Website Builder 3.17.0-beta4
• Elementor Website Builder 3.17.0-dev1
• Elementor Website Builder 3.17.0-dev2
• Elementor Website Builder 3.17.0-dev3
• Elementor Website Builder 3.17.0-dev4
• Elementor Website Builder 3.17.1
• Elementor Website Builder 3.17.2
• Elementor Website Builder 3.17.3
• Elementor Website Builder 3.18.0
• Elementor Website Builder 3.18.0-beta1
• Elementor Website Builder 3.18.0-beta2
• Elementor Website Builder 3.18.0-beta3
• Elementor Website Builder 3.18.0-beta4
• Elementor Website Builder 3.18.0-dev1
• Elementor Website Builder 3.18.0-dev2
• Elementor Website Builder 3.18.0-dev3
• Elementor Website Builder 3.18.0-dev4
• Elementor Website Builder 3.18.1
• Elementor Website Builder 3.18.2
• Elementor Website Builder 3.18.3
• Elementor Website Builder 3.19.0
• Elementor Website Builder 3.19.0-beta1
• Elementor Website Builder 3.19.0-beta2
• Elementor Website Builder 3.19.0-beta3
• Elementor Website Builder 3.19.0-beta4
• Elementor Website Builder 3.19.0-beta5
• Elementor Website Builder 3.19.0-beta6
• Elementor Website Builder 3.19.0-dev1
• Elementor Website Builder 3.19.0-dev2
• Elementor Website Builder 3.19.0-dev3
• Elementor Website Builder 3.19.0-dev4
• Elementor Website Builder 3.19.0-dev5
• Elementor Website Builder 3.19.0-dev6
• Elementor Website Builder 3.19.1
• Elementor Website Builder 3.19.2
• Elementor Website Builder 3.19.3
• Elementor Website Builder 3.19.4
• Elementor Website Builder 3.20.0
• Elementor Website Builder 3.20.0-beta1
• Elementor Website Builder 3.20.0-beta2
• Elementor Website Builder 3.20.0-beta3
• Elementor Website Builder 3.20.0-beta4
• Elementor Website Builder 3.20.0-dev1
• Elementor Website Builder 3.20.0-dev2
• Elementor Website Builder 3.20.0-dev3
• Elementor Website Builder 3.20.0-dev4
• Elementor Website Builder 3.20.1
• Elementor Website Builder 3.20.2
• Elementor Website Builder 3.20.3
• Elementor Website Builder 3.20.4
• Elementor Website Builder 3.21.0
• Elementor Website Builder 3.21.0-beta1
• Elementor Website Builder 3.21.0-beta2
• Elementor Website Builder 3.21.0-beta3
• Elementor Website Builder 3.21.0-dev1
• Elementor Website Builder 3.21.0-dev2
• Elementor Website Builder 3.21.0-dev3
• Elementor Website Builder 3.21.1
• Elementor Website Builder 3.21.2
• Elementor Website Builder 3.21.3
• Elementor Website Builder 3.21.4
• Elementor Website Builder 3.21.5
• Elementor Website Builder 3.21.6
• Elementor Website Builder 3.21.7
• Elementor Website Builder 3.21.8
• Elementor Website Builder 3.22.0
• Elementor Website Builder 3.22.0-beta1
• Elementor Website Builder 3.22.0-beta2
• Elementor Website Builder 3.22.0-beta3
• Elementor Website Builder 3.22.0-beta4
• Elementor Website Builder 3.22.0-beta5
• Elementor Website Builder 3.22.0-beta6
• Elementor Website Builder 3.22.0-dev1
• Elementor Website Builder 3.22.0-dev2
• Elementor Website Builder 3.22.0-dev3
• Elementor Website Builder 3.22.0-dev4
• Elementor Website Builder 3.22.0-dev5
• Elementor Website Builder 3.22.0-dev6
• Elementor Website Builder 3.22.1
• Elementor Website Builder 3.22.2
• Elementor Website Builder 3.22.3
• Elementor Website Builder 3.23.0
• Elementor Website Builder 3.23.0-beta1
• Elementor Website Builder 3.23.0-beta2
• Elementor Website Builder 3.23.0-beta3
• Elementor Website Builder 3.23.0-beta4
• Elementor Website Builder 3.23.0-beta5
• Elementor Website Builder 3.23.0-beta6
• Elementor Website Builder 3.23.0-dev1
• Elementor Website Builder 3.23.0-dev2
• Elementor Website Builder 3.23.0-dev3
• Elementor Website Builder 3.23.0-dev4
• Elementor Website Builder 3.23.0-dev5
• Elementor Website Builder 3.23.0-dev6
• Elementor Website Builder 3.23.1
• Elementor Website Builder 3.23.2
• Elementor Website Builder 3.23.3
• Elementor Website Builder 3.23.4
• Elementor Website Builder 3.24.0
• Elementor Website Builder 3.24.0-beta1
• Elementor Website Builder 3.24.0-beta2
• Elementor Website Builder 3.24.0-beta3
• Elementor Website Builder 3.24.0-dev1
• Elementor Website Builder 3.24.0-dev2
• Elementor Website Builder 3.24.0-dev3
• Elementor Website Builder 3.24.1
• Elementor Website Builder 3.24.2
• Elementor Website Builder 3.24.3
• Elementor Website Builder 3.24.4
• Elementor Website Builder 3.24.5
• Elementor Website Builder 3.24.6
• Elementor Website Builder 3.24.7
• Elementor Website Builder 3.24.8
• Elementor Website Builder 3.25.0
• Elementor Website Builder 3.25.0-beta1
• Elementor Website Builder 3.25.0-beta2
• Elementor Website Builder 3.25.0-beta3
• Elementor Website Builder 3.25.0-dev1
• Elementor Website Builder 3.25.0-dev2
• Elementor Website Builder 3.25.0-dev3
• Elementor Website Builder 3.25.1
• Elementor Website Builder 3.25.2
• Elementor Website Builder 3.25.3
• Elementor Website Builder 3.25.4
• Elementor Website Builder 3.25.5
• Elementor Website Builder 3.25.6
• Elementor Website Builder 3.25.7
• Elementor Website Builder 3.25.8
• Elementor Website Builder 3.25.9
• Elementor Website Builder 3.25.10
• Elementor Website Builder 3.25.11
• Elementor Website Builder 3.26.0
• Elementor Website Builder 3.26.0-beta1
• Elementor Website Builder 3.26.0-beta2
• Elementor Website Builder 3.26.0-beta3
• Elementor Website Builder 3.26.0-beta4
• Elementor Website Builder 3.26.0-beta5
• Elementor Website Builder 3.26.0-dev1
• Elementor Website Builder 3.26.0-dev2
• Elementor Website Builder 3.26.0-dev3
• Elementor Website Builder 3.26.0-dev4
• Elementor Website Builder 3.26.0-dev5
• Elementor Website Builder 3.26.1
• Elementor Website Builder 3.26.2
• Elementor Website Builder 3.26.3
• Elementor Website Builder 3.26.4
• Elementor Website Builder 3.26.5
• Elementor Website Builder 3.27.0
• Elementor Website Builder 3.27.0-beta1
• Elementor Website Builder 3.27.0-beta2
• Elementor Website Builder 3.27.0-dev1
• Elementor Website Builder 3.27.0-dev2
• Elementor Website Builder 3.27.1
• Elementor Website Builder 3.27.2
• Elementor Website Builder 3.27.3
• Elementor Website Builder 3.27.4
• Elementor Website Builder 3.27.5
• Elementor Website Builder 3.27.6
• Elementor Website Builder 3.27.7
• Elementor Website Builder 3.28.0
• Elementor Website Builder 3.28.0-beta1
• Elementor Website Builder 3.28.0-beta2
• Elementor Website Builder 3.28.0-beta3
• Elementor Website Builder 3.28.0-dev1
• Elementor Website Builder 3.28.0-dev2
• Elementor Website Builder 3.28.0-dev3
• Elementor Website Builder 3.28.1
• Elementor Website Builder 3.28.2
• Elementor Website Builder 3.28.3
• Elementor Website Builder 3.28.4
• Elementor Website Builder 3.29.0
• Elementor Website Builder 3.29.0-beta1
• Elementor Website Builder 3.29.0-beta2
• Elementor Website Builder 3.29.0-beta3
• Elementor Website Builder 3.29.0-beta4
• Elementor Website Builder 3.29.0-dev1
• Elementor Website Builder 3.29.0-dev2
• Elementor Website Builder 3.29.0-dev3
• Elementor Website Builder 3.29.0-dev4
• Elementor Website Builder 3.29.1
• Elementor Website Builder 3.29.2
• Elementor Website Builder 3.30.0
• Elementor Website Builder 3.30.0-beta1
• Elementor Website Builder 3.30.0-beta2
• Elementor Website Builder 3.30.0-beta3
• Elementor Website Builder 3.30.0-dev1
• Elementor Website Builder 3.30.0-dev2
• Elementor Website Builder 3.30.0-dev3
• Elementor Website Builder 3.30.1
• Elementor Website Builder 3.30.2
• Elementor Website Builder 3.30.3
• Elementor Website Builder 3.30.4
• Elementor Website Builder 3.31.0
• Elementor Website Builder 3.31.0-beta1
• Elementor Website Builder 3.31.0-beta2
• Elementor Website Builder 3.31.0-dev1
• Elementor Website Builder 3.31.0-dev2
• Elementor Website Builder 3.31.1
• Elementor Website Builder 3.31.2
• Elementor Website Builder 3.31.3
• Elementor Website Builder 3.31.4
• Elementor Website Builder 3.31.5
• Elementor Website Builder 3.32.0
• Elementor Website Builder 3.32.0-beta1
• Elementor Website Builder 3.32.0-beta2
• Elementor Website Builder 3.32.0-beta3
• Elementor Website Builder 3.32.0-dev1
• Elementor Website Builder 3.32.0-dev2
• Elementor Website Builder 3.32.0-dev3
• Elementor Website Builder 3.32.1
• Elementor Website Builder 3.32.2
• Elementor Website Builder 3.32.3
• Elementor Website Builder 3.32.4
• Elementor Website Builder 3.32.5
• Elementor Website Builder 3.33.0
• Elementor Website Builder 3.33.0-beta1
• Elementor Website Builder 3.33.0-beta2
• Elementor Website Builder 3.33.0-beta3
• Elementor Website Builder 3.33.0-beta4
• Elementor Website Builder 3.33.0-dev1
• Elementor Website Builder 3.33.0-dev2
• Elementor Website Builder 3.33.0-dev3
• Elementor Website Builder 3.33.0-dev4
• Elementor Website Builder 3.33.1
• Elementor Website Builder 3.33.2
• Elementor Website Builder 3.33.3
• Elementor Website Builder 3.33.4
• Elementor Website Builder 3.33.5
• Elementor Website Builder 3.33.6
• Elementor Website Builder 3.34.0
• Elementor Website Builder 3.34.0-beta1
• Elementor Website Builder 3.34.0-beta2
• Elementor Website Builder 3.34.0-beta3
• Elementor Website Builder 3.34.0-dev1
• Elementor Website Builder 3.34.0-dev2
• Elementor Website Builder 3.34.1
• Elementor Website Builder 3.34.2
• Elementor Website Builder 3.34.3
• Elementor Website Builder 3.34.4
• Elementor Website Builder 3.35.0
• Elementor Website Builder 3.35.0-beta1
• Elementor Website Builder 3.35.0-beta2
• Elementor Website Builder 3.35.0-beta3
• Elementor Website Builder 3.35.0-beta4
• Elementor Website Builder 3.35.0-dev1
• Elementor Website Builder 3.35.0-dev2
• Elementor Website Builder 3.35.0-dev3
• Elementor Website Builder 3.35.0-dev4
• Elementor Website Builder 3.35.1
• Elementor Website Builder 3.35.2
• Elementor Website Builder 3.35.3
• Elementor Website Builder 3.35.4
• Elementor Website Builder 3.35.5
• Elementor Website Builder 3.35.6
• Elementor Website Builder 3.35.7
• Elementor Website Builder 3.35.8
• Elementor Website Builder 3.35.9
• Elementor Website Builder 4.0.0
• Elementor Website Builder 4.0.0-beta1
• Elementor Website Builder 4.0.0-beta2
• Elementor Website Builder 4.0.0-beta3
• Elementor Website Builder 4.0.0-beta4
• Elementor Website Builder 4.0.0-beta5
• Elementor Website Builder 4.0.0-dev1
• Elementor Website Builder 4.0.0-dev2
• Elementor Website Builder 4.0.0-dev3
• Elementor Website Builder 4.0.0-dev4
• Elementor Website Builder 4.0.0-dev5
• Elementor Website Builder 4.0.1
• Elementor Website Builder 4.0.2
• Elementor Website Builder 4.0.3
• Elementor Website Builder 4.0.4
• Elementor Website Builder 4.0.5
• Elementor Website Builder 4.0.6
• Elementor Website Builder 4.0.7
• Elementor Website Builder 4.0.8
• Elementor Website Builder 4.0.9
• Elementor Website Builder 4.1.0
• Elementor Website Builder 4.1.0-beta1
• Elementor Website Builder 4.1.0-dev1
• Elementor Website Builder 4.1.0-dev2
• Elementor Website Builder 4.1.0-dev3
• Elementor Website Builder 4.1.1
• Elementor Website Builder 4.1.2
• Elementor Website Builder 4.1.3
• Elementor Website Builder 4.1.4
• Elementor Website Builder 4.1.5
• Elementor Website Builder 4.2.0
• Elementor Website Builder 4.2.0-beta1
• Elementor Website Builder 4.2.0-beta2
• Elementor Website Builder 4.2.0-dev2