{"id":86165,"date":"2025-12-30T13:59:16","date_gmt":"2025-12-30T13:59:16","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2023-5922-unauthorized-access-vulnerability-in-royal-elementor-addons-and-templates-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2023-5922-unauthorized-access-vulnerability-in-royal-elementor-addons-and-templates-wordpress-plugin\/","title":{"rendered":"CVE-2023-5922: Unauthorized Access Vulnerability in Royal Elementor Addons and Templates WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

CVE-2023-5922 is a severe vulnerability affecting the Royal Elementor Addons and Templates WordPress plugin. The flaw allows unauthenticated users to access and potentially compromise sensitive content including draft, private, and password-protected posts\/pages. The vulnerability is particularly severe due to its potential for data leakage and system compromise, thus posing a significant security risk to any website using this plugin.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2023-5922
\nSeverity: High (7.5 CVSS Score)
\nAttack Vector: AJAX action and REST endpoint
\nPrivileges Required: None
\nUser Interaction: None
\nImpact: Unauthorized access to sensitive content and potential system compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Royal Elementor Addons and Templates WordPress Plugin | Before 1.3.81<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability resides in the AJAX action and REST endpoint functions of the Royal Elementor Addons and Templates WordPress plugin. These functions do not properly enforce access control, allowing unauthenticated users to access sensitive content. An attacker can exploit this flaw by sending properly crafted AJAX requests to the vulnerable endpoints, thereby gaining access to draft, private, and password-protected posts\/pages.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

A potential exploitation of this vulnerability might look like the following HTTP request:<\/p>\n

GET \/wp-json\/elementor\/v2\/posts\/1234 HTTP\/1.1\nHost: vulnerable-website.com<\/code><\/pre>\n
In this example, the attacker sends a GET request to the REST endpoint of a post (with ID 1234), bypassing the access control and retrieving the content of that post.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview CVE-2023-5922 is a severe vulnerability affecting the Royal Elementor Addons and Templates WordPress plugin. The flaw allows unauthenticated users to access and potentially compromise sensitive content including draft, private, and password-protected posts\/pages. The vulnerability is particularly severe due to its potential for data leakage and system compromise, thus posing a significant security risk to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-86165","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t