CVE-2022-4102 in Royal Elementor Addons Plugin
Summary
by MITRE • 01/10/2023
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 04/09/2025
The Royal Elementor Addons WordPress plugin vulnerability CVE-2022-4102 represents a critical authorization and access control flaw that undermines the security posture of WordPress installations. This vulnerability exists in plugin versions prior to 1.3.56 and specifically affects the template deletion functionality within the Elementor page builder ecosystem. The flaw stems from the absence of proper authorization checks and Cross-Site Request Forgery protection mechanisms when processing template deletion requests, creating a pathway for unauthorized manipulation of content within the WordPress environment.
The technical nature of this vulnerability aligns with CWE-863, which addresses "Incorrect Authorization" in software systems. The flaw manifests as a lack of proper validation to ensure that only authorized users can perform template deletion operations. Additionally, the absence of CSRF protection mechanisms makes the vulnerability susceptible to exploitation through social engineering attacks where malicious actors could craft requests that appear legitimate to authenticated users. The vulnerability does not properly validate whether the post being targeted for deletion is actually a template, allowing attackers to delete arbitrary posts by simply knowing their slugs, which fundamentally breaks the principle of least privilege in access control.
The operational impact of this vulnerability is significant for WordPress administrators and content creators who rely on the Elementor plugin for website building and management. Any authenticated user, including low-privilege subscribers, can exploit this flaw to delete posts that they should not have access to modify or remove. This creates a potential for data loss, content disruption, and unauthorized modification of website assets. The vulnerability essentially allows privilege escalation from subscriber level to content deletion capabilities, which can be particularly damaging in multi-user environments where different roles have distinct access permissions. Attackers could potentially delete important content, remove templates that are essential for site functionality, or disrupt the overall website structure.
The exploitation of this vulnerability can be facilitated through various attack vectors that align with ATT&CK technique T1078.004, which covers "Valid Accounts: Cloud Accounts." An attacker who gains access to a subscriber account could leverage this vulnerability to delete critical posts or templates, potentially causing service disruption or data loss. The low barrier to exploitation, requiring only knowledge of post slugs, makes this vulnerability particularly dangerous as it doesn't require advanced technical skills or extensive reconnaissance. Security teams should consider implementing additional monitoring for template deletion activities and establish proper access control policies to prevent unauthorized content modification. The vulnerability also highlights the importance of proper input validation and authorization checks in WordPress plugin development, particularly for plugins that provide content management capabilities through the admin interface. Organizations should prioritize updating to version 1.3.56 or later to remediate this vulnerability and should conduct thorough security assessments of their WordPress plugin ecosystem to identify similar authorization flaws.