CVE-2022-3805 json
Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass
published 2022-12-22 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-43146
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 1.7%
- EPSS 1.7% chance of exploitation in 30 days, percentile 77%
- public exploits
- 0
- none known, plus a Nuclei check
Summary
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
Patch / fix
- jegtheme jeg_elementor_kit 2.5.7
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
1.69% chance of exploitation in the next 30 days, higher than 77% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Nuclei template Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update nuclei detection template
- plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail= referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N |
Affected products
- jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress
Classification
- Weakness
-
- CWE-639 Authorization Bypass Through User-Controlled Key
- Technology feeds
References
-
plugins.trac.wordpress.org
/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor
exploit, third-party-advisory
- wordfence.com /threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve
-
wordpress.org
/plugins/jeg-elementor-kit/#developers
product, release-notes, third-party-advisory
-
wordfence.com
/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013
third-party-advisory
Sources
- CVE List CVE-2022-3805
- NVD CVE-2022-3805
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.