CVE-2020-13125

An issue was discovered in the "Ultimate Addons for Elementor" plugin before 1.24.2 for WordPress, as exploited in the wild in May 2020 in conjunction with CVE-2020-13126. Unauthenticated attackers can create users with the Subscriber role even if registration is disabled.

CVSS v3.1

6.5 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS v3.0

7.2 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

CVSS v2.0

6.4 MEDIUMAV:N/AC:L/Au:N/C:P/I:P/A:N

EPSS

2.31% chance of exploitation in the next 30 days, 82th percentile

Nuclei

high

Published

2020-05-17

Updated

2024-08-04

Nuclei templates (1)

• projectdiscovery/nuclei-templates/blob/main/http/cves/2020/CVE-2020-13125.yaml

References

• CVE Record
• NVD entry

Related

• CVE-2020-13121
• CVE-2020-1313
• CVE-2020-13119
• CVE-2020-13131
• CVE-2020-13118
• CVE-2020-13132