CVE-2022-4701

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_activate_required_plugins' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to activate the 'contact-form-7', 'media-library-assistant', or 'woocommerce' plugins if they are installed on the site.

• CWE-285

• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046Third Party Advisory
• https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17e?source=cve
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/templates-kit.php?rev=2833046Third Party Advisory
• https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/55f7e39b-e7a5-462b-b1e4-c3d92038f17eThird Party Advisory

Published

Jan 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-46999Tuzicms v2.0.6 was discovered to contain a SQL injection vul…9.8
• CVE-2022-4700The Royal Elementor Addons plugin for WordPress is vulnerabl…8.8
• CVE-2022-47002A vulnerability in the Remember Me function of Masa CMS v7.2…9.8
• CVE-2022-47003A vulnerability in the Remember Me function of Mura CMS befo…9.8
• CVE-2022-47007An issue was discovered function stab_demangle_v3_arg in sta…5.5
• CVE-2022-47008An issue was discovered function make_tempdir, and make_temp…5.5
• CVE-2022-47010An issue was discovered function pr_function_type in prdbg.c…5.5
• CVE-2022-47011An issue was discovered function parse_stab_struct_fields in…5.5
• CVE-2022-47012Use of uninitialized variable in function gen_eth_recv in GN…7.5
• CVE-2022-47015MariaDB Server before 10.3.34 thru 10.9.3 is vulnerable to D…6.5
• CVE-2022-47016Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-4702The Royal Elementor Addons plugin for WordPress is vulnerabl…6.5