Threats tagged 'ghsa-pvrf-6wrj-9xxg'

The Essential Addons for Elementor WordPress plugin up to version 6.8.7 contains a privilege escalation vulnerability via the page_id parameter in the register_user() function. This flaw allows unauthenticated attackers to register accounts with elevated roles such as Editor by exploiting how WordPress revision post statuses and author checks are handled, combined with a publicly accessible nonce endpoint. Exploitation requires that the site permits user registration and that an administrator has previously saved and reverted a non-default user role on a page using the Login/Register widget.