CVE-2024-4858 — Testimonial Carousel For Elementor <= 10.2.0 - Missing Authorization to Limited Setting Update
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option…
Published: 2024-05-25 · CVSS: 5.3 · CVSS 3.1
The Testimonial Carousel For Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_testimonials_option_callback' function in versions up to, and including, 10.2.0. This makes it possible for unauthenticated attackers to update the OpenAI API key, disabling the feature.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7