CVE-2024-0766: 
WordPress vulnerability analysis and mitigation

The Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress contains a vulnerability (CVE-2024-0766) related to unauthorized modification of data. The issue affects all versions up to and including 1.4.4, due to a missing capability check on the templates_ajax_request function. This security flaw enables subscribers and users with higher privileges to create templates without proper authorization (NVD).

The vulnerability stems from a missing authorization check in the templates_ajax_request function within the plugin. The security issue has been assigned a CVSS v3.1 base score of 4.3 (Medium) with the following vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (NVD, Wordfence).

The vulnerability allows subscribers and users with higher privileges to create templates without proper authorization, potentially leading to unauthorized modification of data in the WordPress installation (NVD).

The vulnerability requires an authenticated user with at least subscriber-level access to exploit. The attack complexity is considered low, requiring network access and low privileges to execute (Wordfence).

Users should upgrade to version 1.4.5 or later of the Envo's Elementor Templates & Widgets for WooCommerce plugin to address this vulnerability (NVD).