CVE-2024-0766

Summary

CVE-2024-0766 is a vulnerability affecting the Envo's Elementor Templates & Widgets for WooCommerce plugin for WordPress. The issue stems from a missing capability check within the templates_ajax_request function, which exists in all versions up to and including 1.4.4. This oversight allows subscribers and higher to bypass necessary permissions and modify data unauthorizedly. Consequently, attackers can create new templates, posing a potential security risk for WordPress sites utilizing this plugin.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.