CVE-2024-37255 WordPress ElementsKit Lite plugin <= 3.1.4 - Unauthenticated Broken Access Control vulnerability

What is CVE-2024-37255?

CVE-2024-37255 is a medium-severity missing authorization vulnerability in Roxnor ElementsKit Elementor addons Lite, published on 1 Nov 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Missing Authorization vulnerability in Roxnor ElementsKit Elementor addons Lite elementskit-lite.This issue affects ElementsKit Elementor addons Lite: from n/a through <= 3.1.4.

Weakness: CWE-862

Which versions are affected by CVE-2024-37255?

It affects 1 product.

Products include Wpmet Elements Kit Elementor Addons.

How do I fix CVE-2024-37255?

No fix has been published for CVE-2024-37255 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-37255 being exploited?

There is no known exploitation of CVE-2024-37255 in the wild and no public exploit code.

Other vulnerabilities in Roxnor ElementsKit Elementor addons Lite

• CVE-2024-3499 ElementsKit Elementor addons <= 3.1.0 - Authenticated (Contributor+) Local File Inclusion via Onepage Scroll Module High 8.8
• CVE-2024-2047 ElementsKit Elementor addons <= 3.0.6 - Authenticated (Contributor+) Local File Inclusion in render_raw High 8.8
• CVE-2024-32505 WordPress ElementsKit Elementor addons plugin <= 3.0.6 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-10091 Cross-site scripting in ElementsKit Elementor Addons – Advanced Widgets & Templates Addons for Elementor Medium 6.4
• CVE-2024-3650 Cross-site scripting in ElementsKit Elementor addons and Templates Library Medium 6.4

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-rfmm-6gwh-4p26.