CVE-2024-37255: 
WordPress vulnerability analysis and mitigation

The Elements kit Elementor addons WordPress plugin contains a Missing Authorization vulnerability (CVE-2024-37255) that affects versions up to and including 3.1.4. The vulnerability was discovered and disclosed on June 27, 2024, by researcher Rafie Muhammad. This security issue allows unauthenticated attackers to access functionality not properly constrained by Access Control Lists (ACLs) (Patchstack, WPScan).

The vulnerability stems from a missing capability check in the get_content_editor() function, which enables unauthorized modification of data. The issue has been assigned a CVSS v3.1 base score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. The vulnerability is classified under CWE-862 (Missing Authorization) (Patchstack).

This vulnerability allows unauthenticated attackers to update post data on affected WordPress installations. The security issue has been classified as a Broken Access Control vulnerability, which falls under the OWASP Top 10 category A5 (WPScan).

The vulnerability can be exploited by unauthenticated attackers, requiring no special privileges or user interaction. The attack complexity is considered low, as indicated by the CVSS score (Patchstack).

The vulnerability has been patched in version 3.2.0 of the Elements kit Elementor addons plugin. Users are advised to update to this version or later to remediate the security issue (WPScan).