Sastra Addons for Elementor Missing Authorization Vulnerability in WordPress

A vulnerability exists in the Spexo Addons for Elementor plugin, specifically in the Free Elementor Addons, Widgets and Templates version 1.0.14 and prior. The issue arises from a lack of proper capability checks in the 'tmpcoder_theme_install_func()' function, allowing authenticated attackers with Subscriber-level access or higher to install themes without authorization.

Impact

Exploitation of this vulnerability allows unauthorized theme installation by authenticated users with Subscriber-level access or above.

Remediation

Users are advised to update the Spexo Addons for Elementor plugin to version 1.0.15 or later.