| Package | Affected versions | Patched versions |
|---|---|---|
| royal elementor addons | < 1.3.56 | 1.3.56 |
The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know the related slug.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free