CVE-2024-0766 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Missing Authorization via templates_ajax_request
Subscribers can create templates due to missing capability checks in the Envo's Elementor Templates plugin.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-0766?
CVE-2024-0766 is a medium-severity missing authorization vulnerability in envothemes Envo's Templates & Widgets for Elementor and WooCommerce, published on 28 Feb 2024. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the templates_ajax_request function in all versions up to, and including, 1.4.4. This makes it possible for subscribers and higher to create templates.
Which versions are affected by CVE-2024-0766?
It affects 1 product.
Products include Envothemes Envo\'s Elementor Templates \& Widgets for Woocommerce.
How do I fix CVE-2024-0766?
No fix has been published for CVE-2024-0766 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-0766 being exploited?
There is no known exploitation of CVE-2024-0766 in the wild and no public exploit code.
Other vulnerabilities in envothemes Envo's Templates & Widgets for Elementor and WooCommerce
- CVE-2024-50447 Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce
- CVE-2024-35167 Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce
- CVE-2024-43292 Cross-site scripting in Envo's Elementor Templates & Widgets for WooCommerce
- CVE-2024-0767 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_plugin_activation
- CVE-2024-0768 Envo's Elementor Templates & Widgets for WooCommerce <= 1.4.4 - Cross-Site Request Forgery via ajax_theme_activation
Sources
Also known as GHSA-prwg-rhfj-26j7.