4.3
Medium
CVE-2024-0900 The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits
Description
The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elespare_create_post() function hooked via AJAX in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary posts.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! 2.1 | earliest → 2.1.2 | No fix stated |
| elespare | 2.1.2 | No fix stated |
| EleSpare – News, Magazine and Blog Addons for Elementor 2.1 | earliest → 2.1.2 | No fix stated |
References
- www.wordfence.com www.wordfence.com
- plugins.trac.wordpress.org plugins.trac.wordpress.org
Timeline
- Published
- Last modified