Privilege Escalation in News Kit Addons For Elementor

Executive Summary

This vulnerability affects the News Kit Addons For Elementor WordPress plugin before version 1.4.9. It allows authenticated users with subscriber-level access or higher to install and activate a specific plugin from the WordPress.org repository through an AJAX action called nekit_install_importer. The issue occurs because the plugin does not perform a capability check before allowing this action.

Useful 0 Not Useful 0

Detection Guidance

Check if the News Kit Addons For Elementor plugin version is below 1.4.9. Use WordPress admin panel or run: wp plugin list | grep 'news-kit-addons-for-elementor' in WP-CLI. Inspect AJAX requests for the nekit_install_importer action in browser developer tools or server logs.

Useful 0 Not Useful 0

Impact Analysis

An attacker with subscriber-level access or higher could exploit this to install and activate unauthorized plugins on your WordPress site. This could lead to further compromise of your site, such as malware injection, data theft, or unauthorized access to sensitive information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access or modifications on a WordPress site, potentially exposing user data. This may violate compliance requirements under GDPR or HIPAA if sensitive data is compromised due to the lack of proper access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update the News Kit Addons For Elementor plugin to version 1.4.9 or later immediately. Remove unnecessary user roles with subscriber-level access or higher if they are not required. Monitor for unauthorized plugin installations via WordPress admin logs or server logs.

Useful 0 Not Useful 0