Elementor Website Builder 3.6.0 - 3.6.2 - Missing Authorization to Remote Code Execution

An unauthenticated attacker sends a crafted POST request to any WordPress admin AJAX endpoint that includes an `action` parameter matching one of the onboarding actions (e.g., `elementor_upload_and_install_pro`, `elementor_update_site_name`, `elementor_upload_site_logo`) along with a valid `_nonce` value. The `admin_init` hook in `module.php` [ref_id=1] only verifies the nonce and the `manage_options` capability, but the nonce is created with `wp_create_nonce('onboarding')` and is accessible to unauthenticated users via the onboarding settings endpoint. This enables an attacker to upload arbitrary ZIP files (which are installed as plugins via `Plugin_Upgrader`), upload SVG or other image files, change the site name and logo, activate the Hello Elementor theme, and opt the site into usage data sharing — all without authentication.

The vulnerable code is in `~/core/app/modules/onboarding/module.php` [ref_id=1], specifically in the `__construct()` method's `admin_init` AJAX handler and the `maybe_handle_ajax()` method which dispatches actions like `elementor_upload_and_install_pro`, `elementor_upload_site_logo`, `elementor_update_site_name`, `elementor_update_site_logo`, `elementor_update_data_sharing`, `elementor_activate_hello_theme`, and `elementor_update_onboarding_option`.

The patch shown in the changeset [ref_id=1] adds a `current_user_can('manage_options')` capability check inside the `admin_init` AJAX handler before calling `maybe_handle_ajax()`. The original code already had this check, but the vulnerability existed in versions 3.6.0 to 3.6.2 where this capability check was missing from the AJAX handler entirely. The fix ensures that only authenticated users with administrator-level permissions can trigger the onboarding AJAX actions, preventing unauthenticated modification of site data and arbitrary file uploads.