Threats tagged 'ghsa-9xvg-5x4x-v2hq'

The Royal Addons for Elementor WordPress plugin contains a vulnerability allowing unauthenticated users to modify form action metadata due to missing capability checks on an AJAX action. The nonce intended to protect the action is publicly exposed in frontend JavaScript, rendering it ineffective. This flaw affects all versions up to and including 1.7.1056. Exploitation could lead to unauthorized changes in email, submission, Mailchimp, and webhook settings, potentially enabling data exfiltration or tampering with webhook/email actions.