CVE-2023-47827 WordPress Events Addon for Elementor Plugin <= 2.1.3 is vulnerable to Broken Access Control
Attackers can access restricted functionality due to incorrect authorization in the Events Addon for Elementor WordPress plugin.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2023-47827?
CVE-2023-47827 is a medium-severity missing authorization vulnerability in NicheAddons Events Addon for Elementor, published on 30 Nov 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Incorrect Authorization vulnerability in NicheAddons Events Addon for Elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Events Addon for Elementor: from n/a through 2.1.3.
Weakness: CWE-863
Which versions are affected by CVE-2023-47827?
It affects 1 product.
Products include Nicheaddons Events Addon for Elementor.
How do I fix CVE-2023-47827?
No fix has been published for CVE-2023-47827 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2023-47827 being exploited?
There is no known exploitation of CVE-2023-47827 in the wild and no public exploit code.
Other vulnerabilities in NicheAddons Events Addon for Elementor
- CVE-2024-54315 WordPress Events Addon for Elementor plugin <= 2.2.2 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-49264 WordPress Events Addon for Elementor plugin <= 2.2.0 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-4669 Events Addon for Elementor <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Multiple Widgets
- CVE-2024-12061 Events Addon for Elementor <= 2.2.3 - Authenticated (Contributor+) Post Disclosure
Sources
Also known as GHSA-5pvh-vhhw-w4x6.