CVE-2024-3668
PowerPack Pro for Elementor <= 2.10.17 - Authenticated (Contributor+) Privilege Escalation
CVSS Score
8.8
EPSS Score
0.0%
EPSS Percentile
0th
The PowerPack Pro for Elementor plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.10.17. This is due to the plugin not restricting low privileged users from setting a default role for a registration form. This makes it possible for authenticated attackers, with contributor-level access and above, to create a registration form with administrator set as the default role and then register as an administrator.
| CWE | CWE-732 |
| Vendor | powerpack |
| Product | powerpack pro for elementor |
| Published | Jun 8, 2024 |
| Last Updated | Apr 8, 2026 |
Stay Ahead of the Next One
Get instant alerts for powerpack powerpack pro for elementor
Be the first to know when new high vulnerabilities affecting powerpack powerpack pro for elementor are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
PowerPack / PowerPack Pro for Elementor
0 ≤ 2.10.17
References
Credits
Ankit Patel