CVE-2022-4708

The Royal Elementor Addons plugin for WordPress is vulnerable to insufficient access control in the 'wpr_save_template_conditions' AJAX action in versions up to, and including, 1.3.59. This allows any authenticated user, including those with subscriber-level permissions, to modify the conditions under which templates are displayed.

• CWE-284

• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217Third Party Advisory
• https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71def?source=cve
• https://plugins.trac.wordpress.org/browser/royal-elementor-addons/trunk/admin/includes/wpr-templates-actions.php?rev=2834217Third Party Advisory
• https://www.wordfence.com/blog/2023/01/eleven-vulnerabilities-patched-in-royal-elementor-addons/Third Party Advisory
• https://www.wordfence.com/threat-intel/vulnerabilities/id/b3e12653-ddfe-4e02-9d9e-0263b9f71defThird Party Advisory

Published

Jan 10, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-47070NVS365 V01 is vulnerable to Incorrect Access Control. After …7.5
• CVE-2022-47071In NVS365 V01, the background network test function can trig…9.8
• CVE-2022-47072SQL injection vulnerability in Enterprise Architect 16.0.160…9.8
• CVE-2022-47073A cross-site scripting (XSS) vulnerability in the Create Tic…5.4
• CVE-2022-47075An issue was discovered in Smart Office Web 20.28 and earlie…7.5
• CVE-2022-47076An issue was discovered in Smart Office Web 20.28 and earlie…7.5
• CVE-2022-47083A PHP Object Injection vulnerability in the unserialize() fu…8.8
• CVE-2022-47085An issue was discovered in ostree before 2022.7 allows attac…7.5
• CVE-2022-47086GPAC MP4Box v2.1-DEV-rev574-g9d5bb184b contains a segmentati…5.5
• CVE-2022-47087GPAC MP4box 2.1-DEV-rev574-g9d5bb184b has a Buffer overflow …7.8
• CVE-2022-47088GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffe…7.8
• CVE-2022-47089GPAC MP4box 2.1-DEV-rev574-g9d5bb184b is vulnerable to Buffe…7.8