PT-2020-16469
CVE-2020-26596
·
تاريخ النشر
2020-10-07
·
تاريخ التحديث
2021-07-21
الوصف من
CVSS 2.0
9.0
عاليةالمقاييسAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions
Elementor Pro plugin versions through 3.0.5
Description
The issue allows remote authenticated users to execute arbitrary code because only the Editor role is needed to upload executable PHP code via the PHP Raw snippet.
Recommendations
For Elementor Pro plugin versions through 3.0.5, consider removing the Dynamic OOO widget or restrict availability of the Editor role to mitigate the issue.
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾