{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Essential Addons for Elementor – Popular Elementor Templates & Widgets","vendor":"wpdevteam","versions":[{"lessThanOrEqual":"4.6.4","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"},{"affectedData":[{"cpes":["cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:-:*:*:*:*:wordpress:*:*"],"defaultStatus":"unknown","product":"essential_addons_for_elementor","vendor":"wpdeveloper","versions":[{"lessThanOrEqual":"4.6.4","status":"affected","version":"0","versionType":"custom"}]}],"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"configurations":[{"nodes":[{"cpeMatch":[{"criteria":"cpe:2.3:a:wpdeveloper:essential_addons_for_elementor:*:*:*:*:lite:wordpress:*:*","matchCriteriaId":"2BD6544D-1249-468A-BEF0-3757C7E6A52C","versionEndExcluding":"4.6.5","vulnerable":true}],"negate":false,"operator":"OR"}]}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Essential Addons for Elementor  plugin for WordPress is vulnerable to privilege escalation in versions up to and including 4.6.4 due to a lack of restrictions on who can add a registration form and a custom registration role to an Elementor created page. This makes it possible for attackers with access to the Elementor page builder to create a new registration form that defaults to the user role being set to administrator and subsequently register as an administrative user."},{"lang":"es","value":"El complemento Essential Addons for Elementor para WordPress es vulnerable a la escalada de privilegios en versiones hasta la 4.6.4 incluida debido a la falta de restricciones sobre quién puede agregar un formulario de registro y un rol de registro personalizado a una página creada con Elementor. Esto hace posible que los atacantes con acceso al generador de páginas de Elementor creen un nuevo formulario de registro que tenga como rol de usuario predeterminado el de administrador y, posteriormente, se registren como usuarios administrativos."}],"id":"CVE-2021-4447","lastModified":"2026-06-17T04:19:46.653","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"HIGH","baseScore":8.8,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"LOW","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"exploitabilityScore":2.8,"impactScore":5.9,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2021-4447","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","timestamp":"2024-10-16T19:35:16.303736Z","version":"2.0.3"}}]},"published":"2024-10-16T07:15:10.687","references":[{"source":"security@wordfence.com","tags":["Product"],"url":"https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=2526471%40essential-addons-for-elementor-lite&new=2526471%40essential-addons-for-elementor-lite&sfp_email=&sfph_mail="},{"source":"security@wordfence.com","tags":["Third Party Advisory"],"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/be098ee9-b749-4908-85e8-e717d019609a?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Analyzed","weaknesses":[{"description":[{"lang":"en","value":"CWE-862"}],"source":"security@wordfence.com","type":"Secondary"}]}