RomethemeKit For Elementor Missing Authorization Vulnerability in WordPress Plugin

A vulnerability exists in the RomethemeKit For Elementor WordPress plugin, all versions through 1.5.3, allowing unauthorized data modification. This issue arises from a lack of capability checks in the save_options and reset_widgets functions. As a result, authenticated attackers with Subscriber-level access or higher can alter plugin settings or reset plugin widgets to their default state, with all widgets enabled. Version 1.5.3 partially addresses this vulnerability.

Impact

Exploitation of this vulnerability allows for unauthorized modification of plugin settings and the ability to reset plugin widgets to their default state, all enabled.

Remediation

Users can update to version 1.5.4 or a newer patched version to address this vulnerability.