CVE-2022-4711

Name of the Vulnerable Software and Affected Versions The Royal Elementor Addons plugin for WordPress versions up to, and including, 1.3.59

Description The issue is related to insufficient access control in the 'wpr save mega menu settings' AJAX action. This allows any authenticated user, including those with subscriber-level permissions, to enable and modify Mega Menu settings for any menu item.

Recommendations For versions up to, and including, 1.3.59, update to a version higher than 1.3.59 to resolve the issue. As a temporary workaround, consider restricting access to the 'wpr save mega menu settings' AJAX action to prevent unauthorized modifications to Mega Menu settings.