WordPress CVEs

Description

The Sky Addons for Elementor (Free Templates Library, Live Copy, Animations, Post Grid, Post Carousel, Particles, Sliders, Chart, Blogs) plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the save_options() function in all versions up to, and including, 2.6.2. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary options on the WordPress site. Please note this is limited to option values that can be saved as arrays.

Affected WordPress components

• Sky Addons for Elementor Plugin · sky-elementor-addons
  Confirmed match Active
  Up to and including 2.6.2
  View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

• wowdevs Sky Addons – Elementor Addons with Widgets & Templates — Up to and including 2.6.2
• wowdevs sky_addons_for_elementor — Before 2.6.3

References

• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1267 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/sky-elementor-addons/tags/2.6.1/includes/admin.php#L1290 Product
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3189030%40sky-elementor-addons&new=3189030%40sky-elementor-addons&sfp_email=&sfph_mail= Patch
• plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3193495%40sky-elementor-addons&new=3193495%40sky-elementor-addons&sfp_email=&sfph_mail= Patch
• www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/2a9810a8-311a-424a-bd64-8d25ee891bb5?source=cve Third Party Advisory
• nvd.nist.gov Official NVD record