Missing Authorization in Essential Addons for Elementor AJAX Actions

Up to version 4.6.4, several Essential Addons for Elementor AJAX actions check only a nonce that the plugin prints on public pages, not the user's capability. Any logged-in user, such as a subscriber, can install and activate plugins, change the plugin's settings and clear its asset cache. This vulnerability affects the following application... Weiterlesen: Missing Authorization in Essential Addons for Elementor AJAX Actions