CVE-2023-3124
HighCVSS 8.8Exploitation Probability (EPSS)
Very high risk97th percentile - higher than 97% of all known CVEs
Summary
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to and including 3.11.6. This allows authenticated attackers with subscriber-level capabilities to update arbitrary site options, potentially leading to privilege escalation.
Risk Assessment
The organization is at risk of privilege escalation by attackers, which could lead to unauthorized changes in site configuration and potential security breaches.
Recommendation
It is recommended to update the Elementor Pro plugin to the latest version to mitigate this vulnerability and to conduct a user permissions audit within the system.
Original NVD description (English source)
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.