CVE-2023-3124

The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscriber-level capabilities to update arbitrary site options, which can lead to privilege escalation.

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v3.1

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

22.72% chance of exploitation in the next 30 days, 98th percentile

Published

2023-06-07

Updated

2026-04-08

Proof-of-concept exploits (1)

• AmirWhiteHat/CVE-2023-31245★ · 2023-09-05

References

• CVE Record
• NVD entry

Related

• CVE-2023-3121
• CVE-2023-31242
• CVE-2023-3120
• CVE-2023-31247
• CVE-2023-31194
• CVE-2023-3128