CVE-2024-0835 in Royal Elementor Kit Plugin
Summary
by MITRE • 02/06/2024
The Royal Elementor Kit theme for WordPress is vulnerable to unauthorized arbitrary transient update due to a missing capability check on the dismissed_handler function in all versions up to, and including, 1.0.116. This makes it possible for authenticated attackers, with subscriber access or higher, to update arbitrary transients. Note, that these transients can only be updated to true and not arbitrary values.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 04/12/2026
The vulnerability identified as CVE-2024-0835 affects the Royal Elementor Kit theme for WordPress, representing a critical authorization flaw that undermines the security posture of affected installations. This issue stems from a missing capability check within the dismissed_handler function, which operates across all versions up to and including 1.0.116. The flaw specifically targets the theme's handling of WordPress transients, which are temporary data storage mechanisms used to cache information and manage user interactions within the WordPress ecosystem. Transients in WordPress are designed to provide a secure method for storing temporary data with automatic expiration times, but this vulnerability creates a pathway for unauthorized manipulation.
The technical nature of this vulnerability allows authenticated attackers who possess subscriber-level access or higher to exploit the missing capability check and update arbitrary transients within the WordPress installation. While the transients can only be set to a boolean value of true rather than arbitrary data, the ability to manipulate these temporary storage mechanisms creates significant operational risks. The dismissed_handler function, which should enforce proper authorization checks before allowing transient modifications, fails to validate user permissions adequately. This oversight enables malicious actors to leverage their existing access privileges to modify transient values, potentially disrupting normal site operations or creating conditions for further exploitation.
The operational impact of this vulnerability extends beyond simple data manipulation, as transients are frequently used throughout WordPress for various security-related functions including user session management, plugin state tracking, and administrative notifications. An attacker could potentially manipulate these transients to bypass security measures, disrupt user sessions, or interfere with the normal functioning of security plugins and themes. The vulnerability's classification aligns with CWE-284, which addresses improper access control, specifically focusing on insufficient authorization checks. This weakness allows attackers to perform actions they should not be permitted to execute based on their user roles, creating a potential vector for privilege escalation or persistent disruption of services.
The implications of this vulnerability become more severe when considering the broader attack surface that WordPress themes and plugins present. Since the Royal Elementor Kit theme is designed to provide extensive customization capabilities for WordPress sites, the presence of such a flaw in the transient handling mechanism creates opportunities for attackers to compromise not just individual sites but potentially entire networks of installations. The fact that this vulnerability affects authenticated users with subscriber access or higher means that even relatively low-privilege accounts can exploit the flaw, making it particularly concerning for sites with less restrictive user management policies. Organizations should consider this vulnerability in the context of ATT&CK framework category TA0001 (Initial Access) and TA0003 (Persistence) as attackers could potentially use transient manipulation as a stepping stone for more sophisticated attacks.
Mitigation strategies for CVE-2024-0835 should prioritize immediate theme updates to versions that address the missing capability check in the dismissed_handler function. Administrators should also implement comprehensive monitoring of transient modifications to detect any unauthorized activity that might indicate exploitation attempts. The vulnerability highlights the critical importance of proper authorization checks in WordPress theme development and serves as a reminder that even seemingly minor functionality can create significant security risks. Additionally, organizations should conduct thorough security audits of their WordPress installations to identify similar authorization flaws in other themes and plugins that might present comparable risks. Regular security assessments and adherence to WordPress security best practices remain essential for preventing exploitation of such vulnerabilities and maintaining overall platform integrity.