CVE-2023-49755

The Elementor Timeline Widget plugin for WordPress versions 2.2 and earlier suffers from a missing authorization vulnerability. This flaw stems from incorrect configuration of access control security levels, allowing exploitation of broken access controls [1]. The plugin fails to properly verify user permissions before executing certain functions, which could lead to unauthorized actions.

Attackers can exploit this vulnerability without needing authentication, making it accessible to any unauthenticated user. The broken access control issue may enable attackers to perform actions that should be restricted to higher-privileged users, such as modifying settings or accessing sensitive data. Such vulnerabilities are often used in mass-exploit campaigns targeting thousands of websites [1].

The impact is rated as medium severity (CVSS 5.4). Although the vulnerability is considered low risk for exploitation, it can still lead to unauthorized changes or information disclosure. The plugin developer has released version 2.3, which patches the issue. Users are strongly advised to update to version 2.3 or later to mitigate the risk. Patchstack users can enable auto-updates for vulnerable plugins [1].