CVE-2023-3124

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.

El plugin Elementor Pro para WordPress es vulnerable a la modificación no autorizada de datos debido a una falta de comprobación en la función "update_page_option" en versiones hasta la 3.11.6 inclusive. Esto hace posible que atacantes autenticados con capacidades a nivel de suscriptor actualicen opciones del sitio arbitrarias, lo que puede llevar a una escalada de privilegios.