What’s Vulnerable › Vulnerabilities

CVE-2022-3805: Jeg Elementor Kit <= 2.5.6 - Unauthenticated Authorization Bypass

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-12-22 · updated 2026-06-17
• Weakness: CWE-639

Description

The Jeg Elementor Kit plugin for WordPress is vulnerable to authorization bypass in various functions used to update the plugin settings in versions up to, and including, 2.5.6. Unauthenticated users can use an easily available nonce, obtained from pages edited by the plugin, to update the MailChimp API key, global styles, 404 page settings, and enabled elements.

Affected products

• jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress: before 2.5.7 — fixed in 2.5.7

How to fix

Upgrade to a fixed version: jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress 2.5.7. Check the vendor advisory for mitigations.

References

• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/jeg-elementor-kit/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013?source=cve
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2811758%40jeg-elementor-kit%2Ftrunk&old=2810568%40jeg-elementor-kit%2Ftrunk&sfp_email=&sfph_mail=
• https://wordpress.org/plugins/jeg-elementor-kit/#developers
• https://www.wordfence.com/threat-intel/vulnerabilities/id/c9955d65-afb3-4d28-abd2-9f2fec92d013

Get alerted when CVE-2022-3805 or the next vulnerability affects your stack