4.3
Moyenne
CVE-2024-0900 The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits
Description
The Elespare – Build Your Blog, News & Magazine Websites with Expert-Designed Template Kits. One Click Import: No Coding Skills Required! plugin for WordPress is vulnerable to unauthorized post creation due to a missing capability check on the elespare_create_post() function hooked via AJAX in all versions up to, and including, 2.1.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to create arbitrary posts.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Elespare – Blog, Magazine and Newspaper Addons for Elementor with Templates, Widgets, Kits, and Header/Footer Builder. One Click Import: No Coding Required! 2.1 | premières → 2.1.2 | Pas de correctif indiqué |
| elespare | 2.1.2 | Pas de correctif indiqué |
| EleSpare – News, Magazine and Blog Addons for Elementor 2.1 | premières → 2.1.2 | Pas de correctif indiqué |