CVE-2017-18596 Elementor Website Builder <= 1.7.12 - Missing Authorization

HighCVSS 8.8 EPSS 1.4%

Published: 2019-09-10 13:55
Updated: 2026-06-17 04:13
Exploit status: No public exploit known

Sign in for asset impact Search another CVE

Description

The elementor plugin before 1.8.0 for WordPress has incorrect access control for internal functions.

Affected products

Product	Affected versions	Fixed in
elementor page builder	< 1.8.0	1.8.0
wordpress elementor(WordPress)	< 1.8.0	1.8.0

References

wordpress.org release-notes
wpvulndb.com third-party-advisory
Wordfence Intelligence third-party-advisory
www.cve.org

CVSS v3.1

8.8 High

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

All scores (3)

v3.1 8.8 · nvd@nist.gov
v3.1 8.8 · wordfence
v2.0 6.5 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 1.38% (percentile 72.6)
CWE: CWE-269 CWE-862 Missing Authorization

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.